[Spec] "Pending" messages and DDoS attack

[nrryuya]

If we replace justification with hashes of the latest messages, we need to prevent attackers to send messages with invalid hashes.
Basically, validators will sign the hashed of their messages so attackers can not forge the hashes of messages of other validators. However, attackers can sign an invalid hash with their own key so others can not distinguish whether the sender of a pending message is attacking or there is an inflight message.

[nrryuya]

We need to set some expiration time for pending messages.