Confirm a recovery kit for the key's current share generation

The owner attests they hold the offline recovery kit for this 2-of-3 key at its current share generation (after a refresh, or re-checking a kit they have). The kit and the recovery code never reach 1Claw. The vault checks the public key and generation it is bound to, and kit_proof: a proof, made in the browser from the opened kit, that the kit holds share 3 of the key's current generation (a kit from before a refresh is refused, since the group key alone cannot tell old shares from new). Audited kit.downloaded.