It appears there is an error in the nacl module docs or a bug in 2015.8.0 (https://docs.saltstack.com/en/latest/ref/modules/all/salt.modules.nacl.html). The example config for the master looks like this:

nacl.config:
  key: None
  keyfile: /root/.nacl

But if 'key: none' is set then the key is not loaded from the keyfile and an 'Invalid Key' exception is thrown in the master log.