Use JCS and consider switching to JSON Web Signatures (JWS) for Commit Signatures

[joepio]

Although the current signature spec + implementations (server, client) works, it is very much custom and not well described. I'm still kind of new to all this crypto stuff, so I just picked a proper algorithm and defined a canonical JSON serialization to make both the client and server (which use different libraries) reach consensus on signatures. I didn't know I could just use all the existing JWT / JWE / JWS tooling...

Anyway, this needs to be reflected in the spec, and in both implementations. Gonna take quite a bit of time, but it's the right decision.

• Use JCS in docs
• Use JWS