wipe

Overwrites both byte arrays with zeros. Call this immediately after deriving keys and signing — JVM may not guarantee the wipe is effective (see security notes in plan), but it reduces the window of exposure.

Idempotent — safe to call multiple times.