harden crypto keys handling

Split off from #2525:

- Do not keep cryptographic keys around in Python objects
- Use secure memory for cryptographic keys

This is offered by e.g. sodium_malloc. It works by aligning the data to the end of a page and mprotect()ing the *following* page with PROT_NONE. The remainder of the first page is filled with canary data. Finally another guard page is placed before the page containing the data. All three pages are mlock()d as well, to avoid swapping. Inclusion in core dumps is prohibited as well (MADV_DONTDUMP).

Freeing memory checks the canaries and securely erases the contained data.