Move GenRootKey and GetRootCryptoService to KeyStoreManager, now that they don't depend on client-specific types. Signed-off-by: Aaron Lehmann <aaron.lehmann@docker.com>