Re-encrypts stored signing keys under the current key-encryption key.

Plaintext keys written by older releases are sealed, and keys sealed under another configured key-encryption key are re-wrapped under the current one. Run it once after upgrading, and again after switching the current key id. --dry-run previews the work and --check reports readiness without writing. See mix lockspire.keys.reencrypt --help.