Add server code for striking HMAC values.

See https://moderncrypto.org/mail-archive/messaging/2014/000409.html
Wait for acks from the server when uploading.

This removes a race in the server tests when testing uploads. However,
there is still a race when the upload is truncated because the server
doesn't ack those and the test doesn't know when the server has finished
writing the partial upload to disk.
Allow server to authenticate deliveries using HMACs.

See https://moderncrypto.org/mail-archive/messaging/2014/000409.html
Update threat model document.

PANDA depends on Rinjdael with a 256-bit block size, but that was never
listed. The new HMAC work depends on HMAC-SHA256 and also allows a
server to report a "revoked" error to a contact.