pub type Nonce = [u8; 16];
Host-side 128-bit salt; message nonces stay signer-private until admission.