Only allow HEX-based keys to be imported? ECDSA

### Problem

At the moment, it's a bit confusing which key encryption type you should provide (DER or HEX encoded private keys.

### Solution

The CLI now accepts env vars: `*_KEY` and `*_KEY_HEX`. Let's make this more uniform.

### Alternatives

_No response_

Start by tracing the CLI handling for the *_KEY and *_KEY_HEX environment variables and the ECDSA key import path. Confirm how DER and HEX-encoded private keys are currently accepted, then make the key format behavior uniform so the intended HEX-based input is consistently enforced.

Written by the indexing model from the issue text.