convert to use readpassphrase() instead of DEPRECATED/getpass()
OK millert@

remove unneeded casts

explicit_bzero some keys after use.
From fritjof () alokat ! org, thanks!

ok semarie@

Add pledge support to login_yubikey. Much feedback and OK millert@

KNF a switch statement, moving a local variable up a frame as well -
carefully.

Use explicit_bzero() to zero out the password. From Michael McConville.

Replace <sys/param.h> with <limits.h> and other less dirty headers where
possible. Annotate <sys/param.h> lines with their current reasons. Switch
to PATH_MAX, NGROUPS_MAX, HOST_NAME_MAX+1, LOGIN_NAME_MAX, etc. Change
MIN() and MAX() to local definitions of MINIMUM() and MAXIMUM() where
sensible to avoid pulling in the pollution. These are the files confirmed
through binary verification.
ok guenther, millert, doug (helped with the verification protocol)

missing space in error message

unsigned char for ctype
ok okan kettenis

do not log passwords, even if they are wrong.
ok mcbride halex

Add handling for keyboard layouts which break modhex (like dvorak and many
others); concept and keymap table (covering about 400 layouts) from
modhex.js by Daniel Holth.

ok sthen@, ok halex@ (who also provided much testing and feedback)

Make the per-user counter file r/w by group auth

xlock issue pointed out and diff tested by Andreas Bartelt, thanks!

document login_yubikey options
ok jmc@

remove superfluous RCS identifiers; while here, indent identifier
on Makefile to match style used by other login_* utilities.

ok dhill@

Do not log the password at LOG_INFO, but at LOG_DEBUG instead.
Change the successes from LOG_INFO to LOG_DEBUG as well.

Welcome dhartmei@'s login_yubikey. To be worked on in-tree.

ok millert@
support from mcbride@ and others