Encryption of Welcome messages

[bifurcation]

This was resolved in #80, but recording it in this issue for posterity. A Welcome message carries the init_secret value for the group, and so it needs to be encrypted for the new joiner.

The struct proposed in the revised draft wraps the information in the Welcome in an ECIES ciphertext, and adds enough information to enable the joiner to identify the private key it needs to decrypt the Welcome message.

struct {
  opaque group_id<0..255>;
  uint32 epoch;
  optional<Credential> roster<1..2^32-1>;
  optional<PublicKey> tree<1..2^32-1>;
  opaque transcript_hash<0..255>;
  opaque init_secret<0..255>;
} WelcomeInfo;

struct {
  opaque user_init_key_id<0..255>;
  CipherSuite cipher_suite;
  ECIESCiphertext encrypted_welcome_info;
} Welcome;