Basic preliminary refactoring to make sense of stuff

[aulme]

Bassic refactorings of CloudEncryptionKeyManager, should not have any changes in behavior:

1. Removed public from methods that aren't actually public
2. Moved the only actual public method to the top
3. Rearranged the logic to be a bit less nested, extracted a few helpers
4. Broken up really long lines that don't fit on my laptop monitor
5. Reduced repetition of common test data in the test