Add wrapper type for key IDs

To guard against invalid key IDs and being able to fail early, we should introduce a KeyId type (akin to the UserId type). This change needs to be rolled out in library and CLI crate.