New keys generated without pushing new encrypted env

[Terryda]

1. hx shouldn't create a new key in vinz unless vinz 404s.
2. hx default should just pull the latest instead of passing a keyId, and assume it has access to that key.