Keep: FROST Nostr Signer

The co-signing prompt now shows which request is asking to sign, and marks that label as unverified when nothing has proven it, so a name on its own cannot suggest the request was checked. Random number generation that cannot reach a trusted source now stops the operation instead of quietly continuing with a weaker one. A legacy key share is erased only after a copy is confirmed stored. Stored values are bound to the key they were saved under, so a value cannot be read back under a different key