Fix ECDH-Curve25519 private key masking

[zugzwang]

Curve25519 private key issue

(See #39)

Per the original scheme and RFC7748, private keys are integers in the set

2^{254} + 8 * [0, 2^{251})

(In particular, they must be a multiple of 8, because of the small subgroup - see the cofactor). This translates to the following "masking" operation:

var k [32]byte
// Sample k at random
k[0] &= 248
k[31] &= 127
k[31] |= 64

Currently, private keys are stored and exported "unmasked", which is conceptually wrong since they do not encode integers in the mentioned set.

Correctness within the library works before the "secret key" is masked before concerned crypto operations, but for instance, when exporting, this causes gpg to treat them as if they were encrypted, and keeps asking for a password that doesn't exist.

Fix

Implement the following key-generation procedure:

1. Sample random k in [0, 256)
2. Secret key = Mask(k)
3. Public key = (Secret Key) * G

[twiss]

Nit: this function is technically part of the public API, so we probably shouldn't remove it - even though it does seem unlikely that someone would use it.

Other than that, LGTM 👍

[zugzwang]

As discussed, decided to unexport this function and provide a better name.