Encryption keys are stored themselves encrypted using a
password (kdf+aes-siv construction).

This package was moved over from git.autistici.org/id/keystore and
completely refactored.

The API makes it easier to set custom parameters on hashers. Default
Argon2 parameters were also set to defaults more suited for a
high-traffic authentication service.

Doh, don't know how this was missed until now.

Fixes include:
* only notify systemd after the network socket has been opened
* add net/http/pprof debug handlers
* add /health endpoint for Prometheus blackbox prober

Allows users to specify a set of trusted forwarders in the
configuration, and then using github.com/gorilla/handlers.ProxyHeaders
to rewrite the http.Request parameters according to X-Forwarding-* and
X-Real-IP headers.

Reduces cyclomatic complexity score and makes code more readable.

Before, we weren't releasing the connection properly.

Simply by setting an empty bind DN.

Supports multiple algorithms:
* system crypt
* scrypt
* argon2

We just made up new $something$ prefixes for the new algorithms.

Modeled to follow the net/http ResponseWriter.

Also simplifies handling of the connection pool itself, switching to
using deferred connects, and adds a test suite for misbehaving LDAP
servers to exercise failure modes.

Now the default is for errors to be permanent, unless the error itself
has a Temporary() method that returns true (like the transient network
errors do in the net/ package).

Code 429 is used by the server-side throttling code.

Includes TLS authentication, to authorize peers
based on the subject of their X509 certificate.