key passphrases may live in some sort of secure storage, support running an arbitrary command to retrieve them. Change-Id: I49862cf60f1b73a2356e0c492e1038beef28a95f (cherry picked from commit 9caf8603575aecf51761feaeac6db619be76cfd3)