Consensus requirements in CGGMP

This is a generalization of https://github.com/entropyxyz/manul/issues/11 and https://github.com/entropyxyz/manul/issues/101, to decouple it from the specifics of `manul`. While we would want `manul` to be a general-use library, `synedrion` is currently its only dependent, so it is primarily driven by the needs of the "extended" CGGMP scheme (CGGMP plus an additional key resharing protocol, not a part of CGGMP proper). And this issue aims to establish understanding of what these needs are. ### Theoretical foundation CGGMP (https://eprint.iacr.org/2021/060) describes several n-of-n (no threshold) protocols, claiming that the extension to t-of-n (threshold) is straightforward, but not going into details. The key resharing protocol (for which we use the WWW scheme, https://www.cs.cmu.edu/~wing/publications/Wong-Winga02.pdf) includes threshold natively. Generally, the questions here are: - CGGMP protocols use a "verifiable broadcast" primitive. They don't provide a clear explanation of the required properties. What does CGGMP actually need from it? Is reliable broadcast enough? WWW requires reliable broadcast (without defining it either). - Depending on the answer on the previous question, what specific properties would we require of the verifiable broadcast in the threshold case (so that CGGMP is still secure)? Do we need, at the end of it, for each node `i ∈ S ⊆ P` (where `P` are all the nodes) to be sure that every other `j ∈ S` agrees on the set `S`, and agrees that the broadcasts received by the set `S` are the same as it received? Or are weaker conditions acceptable? - Specifically, when we are creating key shares, is it okay if the set of public shares each node has in the end has a different number of elements, as long as every set is above the threshold needed to recover the full public key? Do they all need to have an intersection that's above the threshold? Or do they have to be exactly the same? - Given the answers to the previous questions, what are the requirements/assumptions for the number of dishonest nodes? Or, to put it in a different way: - What does CGGMP require from a verifiable broadcast in the threshold case? - What does WWW require from a reliable broadcast (hopefully the standard definition)? - require from the protocol execution result ### The minimum solution We could theoretically use the protocols as t-of-t, having the user (`entropy-core` in this case) pre-select `t` nodes, and then iterate until the protocol is successful. Verifiable broadcast in the t-of-t case is much simpler since we don't need to consider different nodes having different subsets of all messages - they either collect everything or fail. But: this adds work to `entropy-core`, makes the execution slower, and, more importantly, we cannot do that for the key resharing protocol, where the threshold is essential. Key resharing would require a custom solution involving e.g. Bracha's algorithm for reliable broadcast.