core: add option sec.crypt.passphrase_file