"hs-descriptor" "descriptor-lifetime" "descriptor-signing-key-cert" "revision-counter" "superencrypted" "signature"