Sign then Encrypt

Ok. Hopefully this addresses all the past feedback. I tried to simplify the PR and still get what we need in. This one is also a prerequisite for #840 as mentioned below. @Renelvon @gubatron take a look.
A contract can get wacky but I don't see why you can't sign a wacky contract. The connection layer shouldn't know what it's encrypting/signing/decrypting/verifying.