* when replicating an inode, replicate each (inode header, payload) pair instead of all headers and then all payloads (makes it easier to do a successful partial write)
* do not assume that we know the device IDs; allow the caller to supply them
* sign and verify the datastore record on datastore-mutate operations
* verify that all tombstones' device IDs cover the caller-given set of device IDs