[noise] Early signatures

[Justin Cormack]

I just remembered, when I was looking at the signature spec I also
wrote out the early signature patterns. These are referred to in the
main spec as having potentially interesting security properties (early
auth) but also have downsides (replay, and also they do not provide
any encryption for the first message unless eg used with a psk or
something else).

Not sure how to name them so here they are with the worst possible
name, as they are in effect negatively deferred patterns so I used a
"-1". Could use a modifier instead.

K-1Nsig:
  -> s1
  ...
  -> e, sig1
  <- e, ee

K-1Xsig:
  -> s1
  ...
  -> e, sig1
  <- e, ee, s1, sig1

K-1K1sig:
  -> s1
  <- s1
  ...
  -> e, sig1
  <- e, ee, sig1

I-1Xsig:
  -> e, s1, sig1
  <- e, ee, s1, sig1

I-1Nsig:
  -> e, s1, sig1
  <- e, ee

I-1Ksig:
  <- s1
  ...
  -> e, s1, sig1
  <- e, ee, sig1