move keys to db for API

[woolfg]

currently to create a new key, we have to add the key, deploy the docker secret and restart the service. this is quite complicated. the keys should be stored encrypted in the DB.