Encryption keys are stored themselves encrypted using a
password (kdf+aes-siv construction).

This package was moved over from git.autistici.org/id/keystore and
completely refactored.