SecureString is identical to std::string except with secure_allocator substituting for std::allocator. This makes casting between them impossible, so converting between the two at API boundaries requires calling ::c_str() for now.
Inline comment and idea come from the encprivkeys branch by Matt Corallo <matt@bluematt.me>.