Reports whether the :key_encryption seam (the key-encryption keys that seal stored signing keys) is configured and valid.

Validation is fresh on every run and never reads the boot-time cache. After the config line it counts stored signing keys per key-encryption key id, plus legacy, unknown and undecryptable rows. Output lists key ids, counts and the legacy-plaintext mode only; it never prints key material. The task exits non-zero when the config is absent or invalid, the database cannot be read, or a stored key uses an unknown key id or cannot be decrypted, or legacy_plaintext: :reject is set while legacy rows remain (the same "broken now" check as mix lockspire.install.verify).