Support a service account file on cloudkms encryption key
Created by: arussellsaw
Managing roles on a top level service account is complicated, it's much easier to create a service account for KMS with only that role assigned, and specifically load that account for the kms client.