This avoids triggering a GitLab push rule which rejects files that look
like secrets.

also move the dkim key generation to the docs as this is only run ~once