dig -k ?

I can't seem to figure out how to set up and use a TSIG keyfile
with dig. I've got it to work with "-y keyname:key" on the command line,
but I'd rather not hang my jewels out for the other users on the
system to see, so to speak. I've tried just the bare mime-encoded
string with "keyname:filename", and a snippet formatted as in the
usual key clause, with no luck.

Thanks....