Allow installing keys to the keyring even when encryption is disabled

There are two parts when communicating with encryption in a cluster. There's encrypting and decrypting. Currently, you have to have an encryption key registered to do both encrypt and decrypt. Since it's possible to have multiple keys in the keyring and switch the primary key, it should also be possible to install a key to the keyring (for decryption) without necessarily installing a primary key for encryption.

No file or test is named in the issue. Start by tracing the encryption and decryption key-registration paths and the keyring setup; done means a decryption key can be installed without enabling a primary encryption key, while existing encrypt/decrypt behavior remains intact.

Written by the indexing model from the issue text.