Support Automatic Key Rotation via the Metastore

This depends on #23

We should allow automatic rotation to be configured in the `MetaStore` such that an attempt to use an overly old key automatically (and silently) triggers creation of a new key. This will maintain the invariant that "No data is encrypted with a key older than `$ROTATION_TIME`." while not causing needless rotations when no encryption is occurring.