Offload crypto to a plugin mechanism to enable HSM and managed cloud crypto support

In the README I see this line:
> NOTE: we are working on providing key management mechanisms that offload the encryption to HSM based modules or managed cloud crypto solutions such as KMS.

This is clearly not happening right now:
* the ticket for KMS was closed as 'wontfix'. #64
* the Hashicorp Vault ticket got closed as Stale: #293

There should be a managed crypto solution eventually, either through direct support, or having a mechanism to offload crypto to an external service.

Crypto could be offloaded to a plugin mechanism so that sealed-secrets doesn't need to directly support KMS and various different HSM solutions, but 3rd party solutions could implement their own crypto offloading.
This possibility was mentioned in the vault ticket https://github.com/bitnami-labs/sealed-secrets/pull/293#issuecomment-544848392

Start with the README note and review the closed KMS issue #64, stale Vault issue #293, and the linked pull-request discussion. The payload names no implementation files, entry points, or tests; establish the plugin boundary and expected external-crypto behavior before identifying code changes and completion criteria.

Written by the indexing model from the issue text.