Some of the secrets were using an invalid format due to (probably?)
being encrypted with a beta version of `age`.
I didn't need to rekey *all* the secrets, but I might as well
This is a bit special, as some of the keys do not belong to NixOS hosts,
so store those in the module itself, and into host-specific directories
for the keys that are NixOS hosts.