octo-crypto AES-256-GCM seal/open of the HD seed at rest (random nonce + salt). No blockchain knowledge. Implemented in Step 3.