Add CFME_TESTS_KEY_FILE support

I also changed the conf loading logic to simplify it: If both an eyaml and yaml
exist in conf/, the unencrypted yaml is loaded and a message is logged saying so.
The need to *not* write out the unencrypted YAML (I think?) made this mtime check unnecessary, so the logic is simpler now. Let me know if I've defeated some other purpose, though.