A root selected through a derived xpub can also appear bare or as a
literal key. Once a spend reveals it, anyone could decrypt the backup.
Exclude such cases.
MuSig aggregation hides participant keys, so account xpubs do not need
individual trailing derivation.
Specify that encryption uses participant roots rather than the aggregate key.
Add MuSig2 test vectors: one for a bare aggregate and one for aggregate
derivation.
Rename keys_types.json to recipient_keys.json and generalize the format
to support multiple descriptors and multiple recipient keys:
- "key": a single key-expression string becomes "descriptors": an array
of complete descriptor strings.
- "expected": an x-only key string becomes "expected_keys": an array
containing that key; null remains null.
Convert the nine existing cases by wrapping each key expression in tr(),
except the uncompressed literal uses pk(), since tr() does not accept it.
Each case has one descriptor.
