KMSACL implementation is not configurable

Currently, it is not possible to customize KMS's key management, if KMSACLs behaviour is not enough. If an external key management solution is used, that would need a higher level API, where it can decide, if the given operation is allowed, or not.
For this to achieve, it would be a solution, to introduce a new interface, which could be implemented by KMSACLs - and also other KMS - and a new configuration point could be added, where the actual interface implementation could be specified.