Feels brittle, e.g. for us remembering to to include new keys here that are added to `CloudLocationConfig`. But not sure how better to do it.

Just thinking aloud, We could try sharing names between CloudLocationConfig keys and SshTool keys, to let SshTool pick out the keys that it understands, but that's likely even more brittle.

So go with this for now.

Also, a shame we can't just merge the config bags and then do a single bag.containsKey/get, but if we want the first bag's keyFile to take presidence over the second bag's keyData then this looks like the best way.