Improve decryption lookup performance

[ejholmes]

The KMS lookup is really handy for field level encryption, but it's also really slow if you use it a lot. This is because:

1. Each ${kms} lookup is a separate network call to kms:Decrypt
2. kms:Decrypt calls happen sequentially, instead of in parallel.

It may be nice to support a new ${decrypt} lookup, using something like NaCl secretbox, backed by a data encryption key from kms. This would allow you to keep a top level data encryption key (e.g. returned from kms:GenerateDataKey) and use it to perform fast decryption of field level values within variables.

An example stacker config might look like:

encryption:
  key_a: ${kms us-east-1@<ciphertext>}

stacks:
  - name: app
    variables:
      SuperSecretThing: ${decrypt key_a@<ciphertext>}

[phobologic]

Sounds likea great idea.