switch to real encryption, real concatenation, real verhash

Still needs real signatures. Also, all tests fail.