authenticity

~leaving this for after the mvp. we have a system of vouching that works well enough for the mvp~

use signatures to perform acl checks is now possible. for this we need to take a bit more care to ensure convergence in the presence of revocations.