Convert to new KeyStore format

keystore no longer stores private key material in the clear. It needs to
use an opaque handle for the private key material and then keystore will
sign the data on the requester's behalf instead of returning the key
material.

Change-Id: I836749769a8519cfc21bfdc2a3b3c8c1a01d8f05