Switch to opaque error type?

Currently, our error type can be printed as a string, which provides a lot of information about the error. Cryptography errors are a notorious source of information leak, as programmers often misuse the errors and either compute on them or expose them in ways that they shouldn't. Ring, for example, takes the much more aggressive approach of having an error type that contains no information at all.

I'm not sure what the right thing for us to do here is, since it seems useful to provide _some_ error information, such as about parsing failures. But we need to strike the right balance, and exposing as much as we do now may be too much. This is also compounded by the fact that a lot of the errors we _would_ want to expose (like parsing errors) come from BoringSSL, and BoringSSL's errors cannot be inspected programmatically.

Start by reviewing the current error type and how cryptography and parsing failures are exposed, then examine the constraints from BoringSSL errors. Clarify which error information should remain available without enabling accidental disclosure; done requires an agreed error representation and corresponding behavior.

Written by the indexing model from the issue text.