Security fix: Do not store digests of signatures.

A digest of its own share of the entropy would allow any authentication server
to mount an offline attack against the user's secret: It would simply have to
try passwords using its own key and see if they match the digest.

Fortunately, there is an easy fix: We can make sure the server is honest simply
by verifying the signature it generates. Therefore, in order for the client to
verify that a given server's response is correct it merely needs to:

- Verify the server is still using the same public values
- Verify the blind signature is valid under those public values

Note that the only thing needing to be stored is the hash of the server's public
values which can be calculated purely from publicly available information and
therefore does not reveal any information about the user's private values.