Use crypto_(secretbox|box)_detached to store the MAC & the msg independently
Sodium already uses arc4random() on __OpenBSD__
Use sodium_memzero()
Same as explicit_bzero(), including dempsky@'s trick to avoid LTO
Use sodium_mlock() and sodium_munlock() to protect keys
Merge pull request #10 from jedisct1/simplify

Simplify code