fix(core): Requires unique kids

[dmihalcik-virtru]

Proposed Changes

• When loading KAS keys, validate that key identifiers are unique
• This will be required as we move to a key ID - first (instead of alg first) method of selecting keys
• While here, moved some of the 'legacy conversion' code into more testable functions and generally improved testing and handling/detection of error conditions, including increasing test coverage of loading/displaying EC keys

Checklist

• I have added or updated unit tests
• I have added or updated integration tests (if appropriate)
• I have added or updated documentation

Testing Instructions

[mkleene]

looks good, the only thing I'd say suggest is that we could be a bit more fussy with the types and have a map[string]rsaKeyLIst or something that that it's clear that we will never fail to pull an RSA or ECC key out of the map.