Give a better error message when deploy encryption key not found

[asmeurer]

Right now it just falls back to using a token, but it should only do that if --token was used.