Generalize signatures and add issuance protocol details and some security considerations

[chris-wood]

We can probably use some more details about replay attacks, but this should get us started.