Finish port to PyCA cryptography
    
    * add missing default_backend
    * unpad encrypted data
    * use cryptography's hashes and HMAC construct
    * remove hard dependency on python-nss from setup.py
    
    Signed-off-by: Christian Heimes <cheimes@redhat.com>
    Reviewed-By: Stanislav Laznicka <slaznick@redhat.com>