just wrap the secret key bytes with the temporary kek, as the nonce prefix was already removed before
prevent NPE when using an RSA key in sshSignatureBlobSign (as occured when running tests)
Merge pull request #2 from gidouin/master

AES 256 keys were exposed as AES 192 keys

LGTM.