assorted: plumb tka initialization & network-lock key into tailscaled

- A network-lock key is generated if it doesn't already exist, and stored in the StateStore. The public component is communicated to control during registration.
 - If TKA state exists on the filesystem, a tailnet key authority is initialized (but nothing is done with it for now).

Signed-off-by: Tom DNetto <tom@tailscale.com>

types/key/nl.go

@@ -6,6 +6,7 @@ package key
 
 import (
 	"crypto/ed25519"
+	"crypto/subtle"
 
 	"go4.org/mem"
 	"tailscale.com/tka"
@@ -29,6 +30,12 @@ type NLPrivate struct {
 	k [ed25519.PrivateKeySize]byte
 }
 
+// IsZero reports whether k is the zero value.
+func (k NLPrivate) IsZero() bool {
+	empty := NLPrivate{}
+	return subtle.ConstantTimeCompare(k.k[:], empty.k[:]) == 1
+}
+
 // NewNLPrivate creates and returns a new network-lock key.
 func NewNLPrivate() NLPrivate {
 	// ed25519.GenerateKey 'clamps' the key, not that it