crypto and key-management api for DeepKey: Keystore & PassphraseManager

[zippy]

This PR

1. creates a Keystore implementation in dpki crate which has the functions necessary for crypto to be usable both by DPKI and other apps that want to do secure crypto functions. The work is based on this spec:
   https://hackmd.io/tVy22HhJQPuHO28gtD_UTQ?both
   and this diagram:
   https://realtimeboard.com/app/board/o9J_kycnaks=/
2. creats a PassphraseManager service/trait for getting passphrases from somewhere (either testing environments, or UIs)
3. Makes Keystores persistable (with encryption using the passphrase)

What it does not do, and needs to be done in future prs is:

1. Actually implement a UI passphrase service
2. Wrap the keystore functions in hdk functions available to running in zomes.
3. Follow the designed bootup sequence, using an instance of DeepKey to actually generate agent keys instead of using our current hc keygen solution

• I have added a summary of my changes to the changelog

[neonphog]

I'm uncertain about having a cache here. Part of the point of the passphrase manager is to give users control over "locking" their authorizor capabilities after an expiration timer, but if they authorize something and their authorizor key gets cached here, then we have to coordinate expiring the cache when the passphrase expires?

[lucksus]

Hm, I get that.

But we do need to hold some secrets unencrypted indefinitely: agent keys in particular.

I would say we might need to add more complexity around this cache so that agent keys stay in, even after the PassphraseManager locks itself up. But everything else gets cleared from the cache at some point, as a default that applies in particular to seeds.. Maybe dependent on the secret type? Or everything gets cleared except for PRIMARY_KEYBUNDLE_ID? What do you think?

[neonphog]

I guess I was imagining anything that needed persistence like for the app keys handling it on that end... i.e. keeping a copy of the secret after requesting it. But definitely something we can iterate on to see what works.

[neonphog]

Nice 👍 This is starting to come together! Couple questions / change requests above.

[neonphog]

Wooo, crypto incoming! lgtm

[zo-el]

👍