Introduce SensitiveError class to indicate errors which should not bubble up

[larabr]

Currently we hide low-level errors that are potentially sensitive in certain higher-level functions (such as message.decrypt). It'd be best to allow the code that throws the error to mark whether it is sensitive, to avoid accidental re-throwing. A SensitiveError should never bubble up to top-level functions.

This distinction can also help debugging since not all errors need to be hidden in principle, even when e.g. parsing a private key.