Change:
As discussed in the mailing list, not having the signature contribute to the new epoch's key schedule leads to a one-off effect where parties stay in sync (with respect to keys) for one more epoch, before inevitably go out of sync. This pull request addresses this issue by including the signature in the confirmed transcript hash rather than the interim transcript hash. See the mailing list for a security consideration of this change. Credit: This pull request was primarily authored by Marta Mularczk; I'm just posting it here for administrative reasons.

Discussion:
Thus the "confirmed_transcript_hash" field in a GroupContext object represents a transcript over the whole history of MLSPlaintext Commit messages, up to the confirmation tag field in the current <del> MLSPlaintext message.  The confirmation tag and signature fields are then included in the transcript for the next epoch.  The interim transcript hash is passed to new members in the GroupInfo struct, and enables existing members to incorporate a Commit message into the transcript without having to store the whole MLSPlaintextCommitAuthData structure. </del> <ins> MLSPlaintext message.  The confirmation tag is then included in the transcript for the next epoch.  The interim transcript hash is passed to new members in the GroupInfo struct, and enables existing members to incorporate a Commit message into the transcript without having to store the whole MLSPlaintextCommitAuthData structure. </ins> As shown above, when a new group is created, the "interim_transcript_hash" field is set to the zero-length octet

objects in cases where it is necessary for the Delivery Service to examine such messages. <ins> The field "confirmation_tag" MUST be present if "content_type" equals commit.  Otherwise, it MUST NOT be present. </ins> External sender types are sent as MLSPlaintext, see external- proposals for their use.

signing private key corresponding to the credential at the leaf of the tree indicated by the sender field.  The signature covers the plaintext metadata and message content, which is all of MLSPlaintext <del> except for the "signature" and "membership_tag" fields.  If the sender is a member of the group, the signature also covers the GroupContext for the current epoch, so that signatures are specific to a given group and epoch. </del> <ins> except for the "signature", the "confirmation_tag" and "membership_tag" fields.  If the sender is a member of the group, the signature also covers the GroupContext for the current epoch, so that signatures are specific to a given group and epoch. </ins> The "membership_tag" field in the MLSPlaintext object authenticates the sender's membership in the group.  For an MLSPlaintext with a

"psk_secret" to 0. Construct an MLSPlaintext object containing the Commit object. <del> Use the "commit_secret" and the "psk_secret" to advance the key schedule and compute the "confirmation_tag" value in the MLSPlaintext.  Sign the MLSPlaintext using the current epoch's GroupContext as context. </del> <ins> Sign the MLSPlaintext using the current epoch's GroupContext as context.  Use the signature, the "commit_secret" and the "psk_secret" to advance the key schedule and compute the "confirmation_tag" value in the MLSPlaintext. </ins> Update the tree in the provisional state by applying the direct path