ME-01 Untrusted Address Book Could Lead to Unavailability

[xoloki]

The library receives as part of its configuration sensitive information including maps linking
key_id values and key_ids to public keys that are not validated. This is a very sensitive
point, as an attacker controlling this address book could gain complete control over the
signing process. Moreover, the config object is missing the coordinator’ s public key, so it
appears there is no way to specify this at signer creation (e.g., you will need to manually set
the variable).