Refining and clarifying identity assertion generation and validation

[martinthomson]

I've made quite a few changes here, all based on my experience with actually building this out.

It needs a little review, probably, but I think that it's correct.

More coming later.