fix the case where public_id and nonce differ

the nonce is stored in the aead, so if it's there, use it
add --random-nonce to yhsm-generate-keys and yhsm-import-keys