This fixes two annotation-indexers from different groupIds to get
bundled.

Jesse's original patch
(cherry picked from commit 01a24e2c)

Jesse's original patch

We are replacing it by the ConfidentialStore class and the
ConfidentialKey class, which provides purpose-specific confidential
information that are separated from each other.

In this way, not all eggs are in one basket, and in case of a
compromise, the impact will contained.

Also replaced several insecure use of digest(secret|messsage) or
digest(message|secret) by HMAC.