How about a memzero() in the destructor of the key class?

[paragonie-scott]

Yep, that's what Halite does. I was going to do that here too.

ext/openssl doesn't have a memzero, but we can do that manually in C.