protect secret signing cert with passphrase

[garlick]

Our design has evolved somewhat so that a user's long term signing keys are only used for an initial job submission. Further job submissions that occur non-interactively will be using a short-term, derived subkey of some sort (see issue #37)

We can then protect the user's secret cert with a passphrase, since it will only be used interactively.

This can be accomplished with libsodium, e.g. see

https://crypto.stackexchange.com/questions/25665/encryting-data-with-password-for-local-storage-using-libsodium