Disable nixops-keys.service if there are no keys

Otherwise, when a machine is rebooted outside of NixOps, services like
httpd won't get started because they'll wait forever on keys.target.