Install and rotate

The installer runs as root once, is idempotent, and never touches a credential. It creates the config empty and root-owned; keys go in afterwards. Adding one prompts on the terminal with echo off. Importing several reads a file — and refuses one that other users can read. A key never arrives as a command-line argument, because argv is readable by every user on the box while the command runs and lands in shell history besides.

An existing key is never replaced by accident. Adding to a label that already exists is refused before the prompt, so nobody types a credential only to have it thrown away; re-running an import file does nothing at all. Replacing is a flag, and it is the deliberate path for rotation: replace the key, restart the service, and no caller changes anything.

The service reads its own config. There is no environment file, because an environment file would load every credential into the process environment, readable for the life of the process in a region no wipe can reach. The type that holds a key zeroes itself on drop, has a redacted debug form, and exactly one accessor.