Crypto: alter Storage interface to create keys inside key store

[reinkrul]

Instead of generating one in application space, and then importing it into the key storage. This allows supporting unexportable keys, meaning keys that never leave the key store.

This is a preparation PR for supporting Azure Key Vault directly.

Kept the SavePrivateKey functionality since it's still used for migrating from one store to another.