More robust parsing of Vault responses

[LaurentRDC]

This PR fixes two things:

• The key must be reached at transit/encrypt/ for encryption, and transit/decrypt/ for decryption;
• The format of the ciphertext returned by Vault looks like "vault:v<some_version>:" , which means that parsing is a little more involved than what was implemented.