Support TLS, dynamic listeners and encrypted storage

What if someone external ends up using `make run` in production? Or we forget about this later and someone uses `SEAL_KEY` somewhere they shouldn't?