Sign then Encrypt

Ok. Hopefully this addresses all the past feedback. I tried to simplify the PR and still get what we need in. This one is also a prerequisite for #840 as mentioned below. @Renelvon @gubatron take a look.
I think this works by accident: `serialized` should be a string, so this checks if `type` is not a substring of `serialized`. I think what you mean is "do this if a `type` field is absent from the JSON dict", so you first need to call `json.loads(serialized)`.