Create and validate seals using threshold signatures.

[afck]

When a new block is ready for sealing, validators use their secret key share to produce a signature share, and broadcast it. Once sufficiently many shares have been received, they generate the block's seal and import the block into the chain.
Seals of received blocks are validated using the public master key of the current validator set.

Ideally, we'd send the share as soon as we create the block. Miner::create_pending_block_at actually returns the new block, so we can create our signature share of header.bare_hash() and broadcast it.

Engine::generate_seal is only called in Miner::seal_and_import_block_internally, which is called in Miner::update_sealing whenever the engine returns SealingState::Ready. We should return Ready only once we have enough shares, and in generate_seal we'd put them together.