Add key listing functionality, replace placeholder subcredentials with values from keystore

This is a new-and-improved version of !1660 (closed).

I have also:

• addressed @Diziet's feedback about the new keymgr APIs
• partially addressed @nickm's code review (this branch is becoming pretty big, so I'd like to address the remaining comments separately)

This will also need some more tests (perhaps the tests can land in a separate MR too)