Two things here: * key secrets are now base64 encoded strings, so we get the full key space * we can pass >1 of them in so we can rotate them
Migrations happen only in the overlord, so there's no thundering herd, and database initialziation can be more easily controlled.