Add support for AWS KMS asymmetric keypair backend

[syndbg]

No description provided.

[weitzj]

As a suggestion:
Maybe you want to look at Google/tink to incorporate various KMS services.

You would also benefit from AEAD to prefect against chosen cipher text attacks. And using tink you get key rotation .

[syndbg]

@weitzj Definitely looks like a step in the right direction.

I was mostly intrigued by the key parsing format and underlying parsers support.

   keyURI = "gcp-kms://projects/tink-examples/locations/global/keyRings/foo/cryptoKeys/bar"

I'll probably invest a bit of time in evaluating google/tink.

Currently, the plan is to get this PR merged to release a mvp AWS KMS enc/dec support for 0.3.0*

[weitzj]

I have an internal tool using google tink with AWS kms and envelope encryption (kms uses a symmetric key which does the envelope wrapping for an tink HybridKeyset (asymmetric)

Key rotation is done on tink keysets.
Using the tink context I can mix encrypted and decrypted data while having the data signed by tink (verify integrity of metadata)
e.g. you could have a “namespace” as a public value of your secret and you can make sure only CODEOWNERS for said namespace are allowed to create their secrets