Thanks Levlaz, that’s helpful.
However it still leaves an open question: What is the environment variable label, or the location of the key within the circleci root container?
I need to actually pass the key as a build-arg when I build using a dockerfile.