Enforce more correspondence between ri and ei

In particular, they have to list the same ed25519 certificate, and
the SHA256 digest of the ei needs to match.