As a user I should see a consistent experience if my HS is not cross-signing aware

[dbkr]

• It may be hard for us to detect that an HS supports cross-signing, as it appears look up cross-signing keys from the DB in bulk matrix-org/synapse#6486 was critical for cross-signing to work at all. This went out in Synapse 1.8 but it doesn't add a /versions flag and there's no endpoint we can check. Neil looking at adding /versions flag.

• What exactly should happen when the HS doesn't support cross-signing? Fall back to legacy verification, ideally, but this could be a complex-ish alternate flow to support.