Support usage of spend authority controlled by a Keystone device

[daira]

This issue is complete once it is possible to install the Zashi app and set it up to use a Keystone device for all funds.

Support for having a Keystone device alongside a non-Keystone account is not tracked by this issue.