Implement cross certification of identity keys with onion keys (prop 228)

Merged as part of #12498 (moved) branch.