Use HKDF for digesting of DH secret key.

 * Previously we truncated the key, which was broken.
 * Secret service spec has been updated.
 * Now we use HKDF + SHA256 to digest the DH secret key into the right
   size usable by AES.
 * The library temporarily still supports the old method in case
   its talking to a daemon that doesn't support this fix.