The communication between the SSO server and the /sso_login endpoint
of the target service (the 't' query argument) can be encrypted using
the NaCl cryptobox, with a new set of keypairs for the SSO service and
the target services.