Universal limitations on quantum key distribution over a network