Intrinsic security for rendezvous control messages

This changeset adds intrinsic security for the rendezvous control
messages between a host and a rendezvous server.

On receiving a control message, the rendezvous server verifies that the
message came from the host matching its public key and with a valid
signature. A timestamp is also included to reduce the possibility of a
replay attack. For now, we don't distinguish between registering a host
for the first time vs. updating its AD with the control message. The
only check is that if a timestamp is known, we verify that a new
timestamp was signed and is greater than the previous timestamp seen.