Password protected secret key

[kyrias]

Before writing the secret encryption key to disk we should use sodiumoxide::crypto::pwhash to derive an encryption key from a password.

This does also bring the question of how to pass in the password: (non-exhaustive list)

• As a command-line argument
• Just passing it on stdin
• Prompt using a curses-like window
• pinentry (sometimes gets into weird finicky states with gpg. might be a gpg bug though.)
• or maybe support all of them?

And now I'm also thinking about looking into storing the secret key using libsecret (gnome-keyring/kwallet), so we don't have to take care of the password protection ourselves at all, hm.