rotation keys and signing keys #29

currently tranquil use the same rotation key and signing key for an individual user and one of these for each user. reference implementation uses a singular rotation key for all users and separate signing keys for each user. both have their pros and cons.

conceptually a PDS is one entity, one DID controller and thus a single key makes sense. however this has its downsides from a security perspective as compromising that single key will compromise every account on the PDS. in that regard tranquil is better. however using the same key as the signing key and as the rotation key also has its security implications. though far less so.

we should consider our options here. probably either keep it as is or switch to a model where each account has its own signing key and its own rotation key which are two different keys. maybe bring in some more cryptography minded people for second opinions.