so that whitelisting doesn't have to peek into the data.
added more documentation and some tests stubs too.

undocumented because we don't want users messing with the option

the password option shouldn't appear in the help message though, to
discourage users to use it as if it was a regular cli feature.

This has been previously encapsulated in a dict, and the commands were
not modified accordingly.

I'm adding some very basic test for the KeymanagerService public api
contract.

- Resolves: #8577

this reverts the refactoring made at 596f1f8
it seems it is now allowed to call a function that yields from inside as
part of an inline deferred.