Users provide a KeyProvider interface.

This allows users to use the JWE header to select a private
key instead of providing one up front.