kops stores Digital Ocean keys insecurely

This was disclosed through Hacker One, but was improperly closed after review; so this disclosure is being done publicly to ensure visibility.

When using kops for Digital Ocean, it supplies API keys through user init. API keys on Digital Ocean are inheriently insecure and must be transmitted securely.

Any unprivileged user with access on a server kicked by kops in Digital Ocean can curl the metadata API and see the API key in plain text when viewing the user data supplied.

This means that an unprivileged user that may have only had access to a single server can become Digital Ocean account god.

A secure method of transmission needs to be used for Digital Ocean API keys, for which user init is not that.

No file or test is named; begin by tracing kops's Digital Ocean user-init path and reproducing whether metadata user data exposes the API key. Define and validate a secure transmission approach, with done meaning unprivileged server users can no longer retrieve the key from metadata.

Written by the indexing model from the issue text.