Consider bootstrap record with separate signature domain. about casm

[lthibault]

@aratz-lasa In connection with #17 and the question of adding a namespace to Beacon payloads: what are your thoughts on this?

As it stands, a Beacon will be able to advertise a peer on a namespace without that peer's approval. The procedure for doing so is as follows:

1. Obtain a valid peer.Record for the node you're targeting.
2. Construct beacon payload using that record, and attach an arbitrary namespace.
3. Serve the record to incoming crawlers.

At first glance this doesn't seem dramatic because consumers of the beacon payload won't be able to connect to a namespace unless the peer is actually serving it, but it might not be so innocuous because:

1. It could potentially be used as a DDoS vector. I can potentially trick a large number of peers into spamming a target with connection requests.
2. A peer may have joined a namespace that it does not wish to make public. Although we can't prevent members of the namespace from leaking the identity of the namespace, we can at least signal to peers that the advertised node does not wish to receive connections on that namespace. (More exactly: recipients of the beacon payload should not attempt connections if they cannot assert that the peer wishes to receive connections, i.e. if the beacon payload was not signed by said peer.)

Maybe we should bundle this into your current sprint?

[lthibault]

Implemented in #33.