deriveBundleKeys: return object with named properties instead of list

I think this makes it safer to use: less chance of getting hmacKey and
xorKey mixed up. I also fixed the missing semicolons in just the lines I
modified.. didn't want to touch the entire file.