By defualt, only superusers can generate security keys.
You can grant password encryption privileges to group administrators.
More Information
Granting password encryption privileges to group administrators