Keys and addresses

Per user: spending key sk → authorization key ak = sk·G, nullifier key nk, incoming viewing key ivk = H(ak, nk), diversified address (d, pk_d = ivk·G_d). Per FI: a messaging key pair (msk, mpk) used to sign wrapper publics and registry writes, and an encryption key pair (esk, epk) used to receive envelopes. msk is meant for an HSM; proving may be outsourced (§4.8). Exact derivations live in reference/src/keys.