lib/param: add "require strong key" option, defaulting to true