Allow installing keys to the keyring even when encryption is disabled about memberlist

[ryanuber]

The main problem with this is that it introduces a potential security hole, where a member receives a new key over an un-encrypted gossip channel. The key transmitted in clear text would allow any MITM to obtain full access to the cluster simply by observing the key and joining. In order to talk to any member in the cluster, a member must possess a valid primary encryption key. Memberlist purposely does not act on messages received which are not decipherable with any key in the ring to protect against this. There is probably room for a better secure introduction flow, but it is likely more complicated to do it correctly.

[jsternberg]

What about if additional keys could be introduced from some bootstrapping mechanism like the config file? You would also likely need to mark which messages had been decrypted so you avoid accidentally installing an unencrypted key into the cluster. The main problem is that initially bootstrapping encryption requires taking the server offline at the moment. Is there any way to do a rolling restart while enabling encryption on the cluster?

Would you guys be open to a patch that attempts to implement this functionality?

[rboyer]

@jsternberg I submitted a consul PR that has a variation of this implemented: hashicorp/consul#2141