Getting this to work in a convenient way turned out to be a lot more
work than I expected. Also re-keying stuff is incredibly painful now
because there is no age agent. Oh well I guess.

This also allowed the deployment script to be vastly simplified, and I
took a moment to put it in `bin/` and modified `.envrc` to include it in
`$PATH`. You could just use `nixos-rebuild` directly, but this script
means I have to type less in the common case.