Move key generation to tincctl.