load keys whitelist from yaml