XMSS: Outline and implement XMSS^MT

[marsella]

There's a second version of XMSS that layers the trees even more so you can get more signatures out of a key. This is the full amount of work required to support it; it may be better to implement this in several PRs.

• Decide on module structure and rearrange if necessary (XMSS and XMSS^MT share many components, but the shared functions should mostly not be part of the public API, so try to choose a structure that promotes reusability but maintains the appropriate publicity for functions that are not to be used outside of the implementations).
• Define types (keys, signature)
• Implement key generation, signing, and verification
• Document efficiency concerns with the spec-as-written version, explain pseudorandom key generation and any other optimizations that are recommended in the spec.