I'm not a big fan of `coerceToBytes`. It has a bad name -- I had no idea it was expecting either a hex string or byte array. So far it's only used in transaction.js. I'm tempted to make the method only local to transaction.js or even better: only allow hex string to be passed into `Transaction.prototype.validateSig` as `sig` and `pub`. Thoughts?