As with #105 we moved the merkle and tmhash package from tmlibs to go-crypto.

This issue makes sure the following issues / comments / discussions do not get lost:

• merkle: add comment on 2nd pre-image (or other relevant) attacks: Bring in merkle and tmhash from tmlibs #105 (comment)
• merkle: add to package description: when is using this safe and how so? also, differentiate between leaf and interior nodes
• (if not addressed in Bring in merkle and tmhash from tmlibs #105): are we hashing things of always the same size? if so make this as explicit as possible, if we do not, we need some basic encoding (prefix with len as before len-prefix is back dont length prefix hashes during concatenation tmlibs#211) see:
  Bring in merkle and tmhash from tmlibs #105 (comment) and dont length prefix hashes during concatenation tmlibs#211 (comment)