feature: add key fetching from new CS

[aaronbojarski]

The new CS only allows HOST-AS and HOST-HOST keys to be fetched.

The fetching and especially the caching of these keys needs to be added. This will involve:

• implementing the actual fetching.
• adding logic to the keyfetcher when to fetch which key. (And when can it be derived instead.)
• adding caches to the keymanager (what kind? how big?)
• adding logic on what to do if key is not available yet. (Best effort?)