Add best practices on key management & not getting hacked

[orishim]

We should add this to Development Best Practices section specifically geared towards developers (avoiding malicious dependencies, accidentally committing your real keys, etc.