merge version 3.0 from Twitter

This includes the following changes:

- [SECURITY-11509]: correctly generate fingerprint
   This introduces an incompatibility between version 2.1/2.2 and this
   version, which did not correctly generate a fingerprint for ssh pubkeys
   with a small exponent.
- [SECURITY-11290]: re-introduce backwards compatibility with username-fp
  format
- sort cap options properly
- re-add "-f" description into usage

- remove dependencies on openssl(1) and ssh-keygen(1) altogether by
  rewriting all encryption/decryption natively in Go
  (this happens to also address [SECURITY-11186])
- fix tyop in usage