NATS with the NKey seed, password or token off the heap: an AuthHandler that signs server challenges in native memory with Ed25519 (for bare NKey seeds and .creds files), and a DataPort whose connections encrypt with seclume's own TLS 1.3 and write a password or token into the CONNECT handshake from native memory.