note about checking vrf pk thru auditor

kt/auditor.go

@@ -7,6 +7,20 @@ import (
 	"sync"
 )
 
+/*
+TODO: consider adding a simple static vrf pk check to the auditor.
+i think it might be hard to justify the current vrf agreement assumption.
+can't just get it from the server.
+could get it from the binary, but then someone else needs to monitor
+the binary versions to check that it's the same across binaries.
+that's additional to monitoring for good code.
+it's more straightforward if clients to audit, learn that their vrf
+pk is good, and then move forward.
+shouldn't be that bad to implement either, ish.
+add another sigpred msg type to the auditor, which is just
+a ghost var that contains the vrf pk.
+*/
+
 type Auditor struct {
 	mu       *sync.Mutex
 	sk       *cryptoffi.SigPrivateKey