I think adding `golang.org/x/crypto` as a second dependency is fine. It's basically stdlib at this point (though slightly less stability guarantees).