Refining and clarifying identity assertion generation and validation

I've made quite a few changes here, all based on my experience with actually building this out.

It needs a little review, probably, but I think that it's correct.

More coming later.