NewCredentialManager creates a new CredentialManager which can create and verify authenticated credentials Credentials are created with `key` but validated against `key` and all `extraSecrets`.

CredentialManager authenticates and verifies rescue node credentials.