Add HSM support via PKCS 11

[enj]

Use https://github.com/miekg/pkcs11 and possibly the extended wrapper https://github.com/ThalesIgnite/crypto11 to add HSM support.

Would require having a very different mode:

1. The current command based KEK mode where we do the crypto
2. An HSM mode where we send the DEK/EDEK to the HSM for all crypto operations