Lvm encrypt instead of barbican

barbican is not yet part of "OpenStack" proper, and we are jumping through lots of hoops to include it:
  - barbican patches to include basic key-gen functionality
  - custom code to generate KEK images
  - custom build process to build new KEK images
  - nova patches to support barbican
  - proprietary config to download all of the above

This introduces a great deal of complexity, for the simple requirement of encryption
of data at rest, which could be more easily satisfied by:

Why not just do lvm kernel encryption?
  - less effort to keep up with upstream
  - less un-vetted crypto code
  - same interface: `on boot: enter passphrase"
  - no patches
  - consistent with existing infrastructure
  - consistent with existing HIPAA reqs

Seems much simpler to just encrypt lvm volume files.