Prints a new key-encryption key and the config/runtime.exs block that reads it.

The key encrypts Lockspire signing keys at rest. This task writes no files, needs no database and does not load your app config, so it works before the key exists. The key is printed once; store it in your secret manager as LOCKSPIRE_KEY_ENCRYPTION_KEY.

Options

• --id ID - the key id used in the config block (default: the current month in UTC, as YYYY-MM).
• --raw - print only the key, on one line. The key id is not part of that output, so --id has no effect with --raw (an invalid id is still rejected).
• --help - show usage.