Sanitized use of MVCC keys throughout the storage layer

Also documented MVCC design decisions.
Using the same type for both encoded and unencoded keys seems like a bad idea; we should have distinct types for the two cases. The encode and decode methods are not symmetrical; encode returns a `Key` but decode takes a `[]byte`.