Allow the parameter store which contains the private portion of a dynamically generated AWS::EC2::KeyPair to be KMS encrypted with a specific key

### Name of the resource

Other

### Resource name

AWS::EC2::KeyPair

### Description

We are very happy we're able to have CloudFormation autogenerate and maintain an SSH key public/private pair. When the private half gets shipped off as a securestring to the parameter store, it is encrypted with the account-wide alias/aws/ssm KMS key.

It would be great if we could define the KMS that is used for encrypting the value in the parameter store so we can scope the access to the key to only resources associated with a user or application that relate to the EC2 key itself.

### Other Details

_No response_

The issue concerns AWS::EC2::KeyPair, Systems Manager Parameter Store, and KMS, but names no repository files, tests, or implementation entry points. Start by reviewing the CloudFormation resource behavior and related AWS service documentation; done would mean supporting a user-specified KMS key for encrypting the generated private key in Parameter Store.

Written by the indexing model from the issue text.