Let the server echo the epoch.

There's no need for the server to determine its own epoch.
Make the server simply echo the client's epoch.

That's only relevant for UniformDH.
When authenticating, also test epoch boundaries.

On occasion, a client's or a server's epoch might already have increased
whereas the epoch of the other party didn't.  This is a benign event and there
is no reason to fail authentication because of this.  As a result, as a server,
we now also test boundary values, i.e., epoch - 1, epoch, epoch + 1.
Add missing reference.
Fix ticket handshake spec.

The first message makes use of the HMAC key which is derived from the master
key.  It does not use the master key itself.