Secrets are never tool arguments

Signing keys are read from the server process environment. No tool accepts one as an argument, so an agent never handles a key, and a key cannot end up in a transcript. A missing key returns an error result explaining which variable to set.