Right now we assume keys are stored unencrypted. That's probably not going to fly with everyone, and since NSS-using apps typically support storing a PIN in a file somewhere when unattended operation is required, we probably need to support it, too. This needs to be tracked and handled on a per-request basis, since key locations can be different for each.