Clarifying the Key-generation verification spec

[vteague]

Generic Issue

Description
The key generation spec, and the associated verification, need a bit more clarity, particularly about what should happen when something goes wrong. At the moment, they generally assume reliable broadcast throughout, but the current implementation (and probably most future implementations) only have point-to-point communication.

Possible Solution
Perhaps we could assume a reliable broadcast step at the end, i.e. that the transcript of the key generation protocol is posted on the Bulletin Board (the precise definition/implementation of which can be deferred), and describe what attacker model can be defeated in that communication model.