Accept encryption key through environment variable

Currently a key is passed from configuration file or as a command line argument:
http://www.serfdom.io/docs/agent/encryption.html

Passing keys through environment variables is a common way to "avoid other users from being able to discover it by inspecting running processes".