Generate key by default without unlocking secret part. Use options parameter for generate method

Currently key.generate returns a private key with unlocked secret key part. This can lead to a kind of hidden password caching behaviour, as the key is usable without password for the rest of the browser session. With this PR:
- the key object returned by key.generate is by default locked,  parameter `unlocked` allows to change default
- parameters of key generate methods are passed with one `options` parameter