More refactoring (separate crypto stuff from passman.go)