It turns out the bate secret key for machine files already has the pubkey
cached in it by libsodium, so I dropped that.
I'm also going to drop it from the internals, it seems simpler
- Save with 0400 perms so PTTH won't accidentally serve them
- Save D-Bus machine ID if possible to detect when keys accidentally change machines
- Add random schema version
_