KeyExchange: signed_version, the server's signature over its version

The echo catches an advertisement lowered in the clear only once a tagged
frame arrives, so the initiator's first frame has already gone out under
the lower version by then. A server that signs its version instead sets
bit 255 of the ephemeral X25519 key inside the signed keys[0] and puts
sign("rdkx-ver" || key || version LE) here. RFC 7748 masks that bit, so
the box opens as before on either side, and a legacy server, whose keys
are canonical, never sets it. A client that sees the bit, or the field,
verifies before trusting the version, so the pair settles it at the
handshake rather than one frame pair later.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_019aokqJuhjvB3kijXtAg5Ns

protos/rendezvous.proto

@@ -238,6 +238,9 @@ message KeyExchange {
   // From the server: the newest key exchange version it speaks. From the client: the version it
   // picked, the highest both speak. Absent, i.e. 0, is the original scheme.
   uint32 version = 2;
+  // Server signature of "rdkx-ver" || on-wire ephemeral public key || little-endian uint32 version.
+  // Bit 255 of the signed X25519 public key requires this field; legacy keys leave it clear.
+  bytes signed_version = 3;
 }
 
 message HealthCheck {