WIP: Add session hash and remote CCS

PR so this can be reviewed.
ClientKeyShares (plural) or ClientKeyShare (singular) ?