Only derive PartialEq and Eq for PrivateKey for tests

We shouldn't compare private keys in prod for side-channel resilience. Ideally
we shouldn't clone too. We currently do for storage. Fixing this would probably
require to serialize the private key in the credential struct.

src/ctap/crypto_wrapper.rs

@@ -89,7 +89,9 @@ pub fn aes256_cbc_decrypt(
 }
 
 /// An asymmetric private key that can sign messages.
-#[derive(Clone, Debug, PartialEq, Eq)]
+#[derive(Clone, Debug)]
+// We shouldn't compare private keys in prod without constant-time operations.
+#[cfg_attr(test, derive(PartialEq, Eq))]
 pub enum PrivateKey {
     Ecdsa(ecdsa::SecKey),
 }