Add key derivation

[cab404]

All of the building blocks are already there — I just need to implement a proper takeover, so older configs won't immediately break.

Probably make key an optional field in the peer, so it can be derived with a peer plugin