Encrypt private keys at rest

Ideally the private key should be encrypted at rest using https://guides.rubyonrails.org/active_record_encryption.html. However, it needs key generation and configuration in the main Rails app, so I think it will need to be controlled by a configuration option.