cg_new_token_key() makes a new random key (64 hex digits) for
cg_vault(). cg_key_fingerprint() returns 16 hex digits that identify a
key without revealing it; saved keyed vaults record it, so opening one with
the wrong key fails. Both need the openssl package.