Support providing UUID and key on PUT

Soon this will be limited to remote cluster peers to keep UUIDs and
on-disk encrypted payloads synced, but for now it's just an open
vuln.
Move AES key to meta field