keys.*: Enforce separation between user's files and the system.

keys.*: Enforce separation between user's files and the system.

  * keys.new-keeper now writes its nubs into $SAFE rather than the
    caller's current directory.

  * keys.reveal and keys.stash insist on reading their input from stdin
    rather than a file name.

  * keys.keeper-cards writes its output to stdout, and collects input
    nubs from $SAFE.

  * keys.keeper-nub is a new tool which extracts a keeper nub on demand.

Some of the tools have also had their error messages improved.