This is shared code used by id/auth, id/keystore, and others. Unifying
it into its own package helps prevent drift among implementations.