We want to refer to keys by alias, so that we can rotate the key.

However, we need to be able to get an ARN from the alias, and we need to be able to add policies to the original key.