* Added support to read openssh public keys and encrypted private keys
* reworked private key handling
* made password the default; generating keys without password
requires explicit "--no-password"
* use protobuf for encryption-header
* use fixed size file-header (42 bytes) before the encryption-header
* add encryption/decryption contexts
* teach MakePrivateKey() to fixup its internal public key bits