Flexible crypto options

I've added support for the following algorithms, configurable at setup time:

Supported `encryptionAlgorithm`s (all are in CBC mode):
- `aes128`
- `aes192`
- `aes256`

Supported `signatureAlgorithm`s:
- `sha256`
- `sha256-drop128` (does HMAC-SHA-256 then discards the last 128 bits)
- `sha384`
- `sha384-drop192`
- `sha512`
- `sha512-drop256`

I've also documented the use of `encryptionKey` and `signatureKey` and their relation to the `secret` parameter.