Implement cross certification of identity keys with onion keys (prop 228)

Merged as part of legacy/trac#12498 (moved) branch.