Keypers reject keys and key shares messages from different sets

[jannikluhn]

When a keyper receives a message for an eon in which they are not a keyper, they reject it:

• rolling-shutter/rolling-shutter/keyper/epochkghandler/key.go

  Lines 48 to 56 in 313f2b3

  	_, isKeyper, err := queries.GetKeyperIndex(ctx, int64(key.Eon), handler.config.GetAddress())
  	if err != nil {
  	return pubsub.ValidationReject, err
  	}
  	if !isKeyper {
  	log.Debug().Uint64("eon", key.Eon).Msg("Ignoring decryptionKey for eon; we're not a Keyper")
  	return pubsub.ValidationReject, nil
  	}

• rolling-shutter/rolling-shutter/keyper/epochkghandler/keyshare.go

  Lines 50 to 57 in 313f2b3

  	_, isKeyper, err := queries.GetKeyperIndex(ctx, int64(keyShare.Eon), handler.config.GetAddress())
  	if err != nil {
  	return pubsub.ValidationReject, err
  	}
  	if !isKeyper {
  	log.Debug().Uint64("eon", keyShare.Eon).Msg("Ignoring decryptionKey for eon; we're not a Keyper")
  	return pubsub.ValidationReject, nil
  	}

This is a problem because it means that especially around the time of a keyper set transition, messages have a hard time propagating through the network.

Instead, keypers should validate decryption keys against the eon key broadcasted via the broadcast contract. For decryption key shares it is tricky because the eon key shares are unknown to the public. A potential solution would be to require shares messages to be signed by the originating keyper.