Only characters which are valid hexadecimal characters will properly
add entropy to the string.
Since we have to change this anyway, change the hashing to loop
through 10000 iterations of Keccak, as a kind of poor man's KDF,
to harden against brute force attacks.
The Keccak code is taken from https://github.com/emn178/js-sha3,
under MIT licence.
Thanks to luigi1111w for spotting the bug, suggesting the best
way to fix it, and pointing to the keccak library above.
