Create the site's public/private key on module install time

Problem/Motivation

... and also automatically remove it when the module is uninstalled and enforce manual removal via an uninstall validator.

If we only going to have one public/private encryption key per site (instance) then we can move the encryption key creation to module install time, at least the first attempt for setup keys could happen there, an the key provider *may* have fail-safe in it to create missing public/private keys if necessary. (However if the install time logic is implemented I would probably prefer not having a automatic fail-safe in the key provider, but probably instead a requirements check with an admin UI to fix the incorrect configuration if necessary. TBD)

Steps to reproduce

Proposed resolution

Remaining tasks

User interface changes

API changes

Data model changes