This implements NixOS/rfcs#136. This issue is agreed-upon by the https://github.com/orgs/NixOS/teams/nix-team

• Make sure global flags are used consistently
• Otherwise stabilise as is
• Would be great if we had some default behavior for setting up keys and putting them into standard location
  • Have to figure out the details as some may have to be system-wide, some are specific to a store, etc.