Documentation
+ Randomized testing
  Even more aggressive testing
  - stream huge files (of noise?)
  - drop random secrets into them
  - verify no secrets in output
  Excessive copies
  Mask buffer is probably a good interface