Support dynamic validator sets

[mappum]

For simplicity, the code currently assumes the validator set does not change. The design supports changing validator sets in theory, but there will be some extra edge cases to handle, e.g. deposits sent to an outdated signatory set (in this case we'll have to check if the current signatory set can still spend the output, etc.).