(Optionally) restrict list of available keys

Followup to these issues:
- https://github.com/d8-contrib-modules/encrypt/issues/71
- https://github.com/d8-contrib-modules/encrypt/issues/36

This will most likely need collaboration with the Key module, to expand how the key filtering functionality works.