Support keys (both signing and SB) from env instead of only file

[mikn]

Currently you support the signing keys and SB keys only from file or kms/ssm - it would be hugely helpful if you, at least in the first step, allowed also for env variable key material also.

We will probably also in the longer-run want to support additional KMS-implementations (like GCP), but realise that is a larger project.