addKey method
Files material in the container its own enrollmentId names — that
enrollment's when it has one, the atSign's when it is null.
This is the write path, so it refuses a second live enrollment: one per install is what this build produces. Reading does not, and the asymmetry is deliberate — see AtKeysAssurance.refuseSecondLiveEnrollment.
Implementation
void addKey(CryptographicMaterial material) {
const AtKeysAssurance()
.refuseSecondLiveEnrollment(existing: keys, candidate: material);
_file(material);
}