-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1
https://fedorahosted.org/sssd/ticket/752
I think we can leave initialization as it is now - since we only get the obfuscated password once at the startup. If we needed to treat that functionality as a library, we might need to switch to NSS_InitContext() and NSS_ShutdownContext() per Bob Relyea's advice.