> With regard to the thirdparty package in core, I don't see that we need it any > more. The only thing in it is pbkdf2, which is available from go.crypto which we > import from anyway for ssh authorised keys functionality. So I say we nuke it. I'm going to fix this right now.