Turning up logging for the IdP data sealer

[Cantor, Scott]

So, --importpass appears to me to be doing PBE, password-based encryption. It's treating the input as a password. If I were to guess, that might be salting, probably randomly. Pulling that back out as a byte array might give you different salted bytes on different servers if it's randomly salting.

The input here is certainly not a password and I doubt that doing that is really the right thing to do.

I don't think there is a way to import a key from the command line using keytool.

If you're going to indirect things, I think you really have to do what I said needed to be done from day one, this has to be a different KeyStrategy that isn't using a keystore.

I don't personally think all this is warranted, but I don't see any sort of middle ground. I think probably if you were to try to make me solve this, I would do it by adding an option to support encoded input to the existing command line program I created and use that to allow importing a known key rather than it generating the key like it does now.

-- Scott