Consider having verifiable sensitive fields in auth debugging

A follow up to #589

Some fields we need to be extra careful about logging. Such as private keys.

We currently just print `[censored]` for them in debug strings.

As @coryan suggests, we could instead print a hash of these fields. That would at least let applications check if the field's value is what they are expecting.