Goal: 

• When using SimpleCrypto backend in Barbican, each Project is assigned a Project-specific Key-encryption Key (pKEK).  This pKEK is created automatically the first time a user with a role on that specific project submits a request to barbican do do cryptographic work.  This pKEK is used to encrypt all secrets owned by the project.
• Currently there is no way to easily rotate these pKEKs 

Acceptance Criteria:

• A mechanism is provided to create a new pKEK for a specific project
• A mechanism is provided to re-encrypt existing secrets using a specific (the latest) pKEK