func NewSecretString(rand io.Reader) string {
	b := make([]byte, 16, 18)
	if _, err := rand.Read(b); err != nil {
		panic("error reading from rand: " + err.Error())
	}
	h := sha256.New()
	h.Write(b)
	digest := h.Sum(nil)
	b = append(b, digest[0], digest[1])
	return generatedSecretStringPrefix + hex.EncodeToString(b)
}
NewSecretString generates a random, human readable string with a special
form that includes a checksum which allows typos to be rejected (so long as
the typo isn't in the first two letters).
package panda
import (
	"bytes"
	"crypto/sha256"
	"encoding/binary"
	"encoding/hex"
	"errors"
	"io"
	"os"
	"os/exec"
	"runtime"
	"strconv"
	"strings"
	"sync"
	"github.com/agl/pond/panda/rijndael"
	"github.com/golang/protobuf/proto"
	"golang.org/x/crypto/curve25519"
	"golang.org/x/crypto/hkdf"
	"golang.org/x/crypto/nacl/secretbox"
	"golang.org/x/crypto/scrypt"
	panda_proto "github.com/agl/pond/panda/proto"
)
const (
	generatedSecretStringPrefix = "r!"
	generatedSecretStringPrefix2 = "r["
)