use new cryptohash unified API

* remove base16-bytestring dependency
* depend on cryptohash >= 0.8 && < 0.10