Switch back to just one token with both Zone/DNS/Edit and Zone/Zone/Read permissions for 'All zones from account'
Separate "authors" keys and "deploy" keys. Add features to setup, encrypt, and decrypt scripts: - Validate input arguments - Set age keyfile and recipients dynamically at runtime
