* The current rules for when an Activity Entered is accepted allow it to
  refer to an older activity than the last one. If echoing is disabled,
  two Activity Entered could be sent, each pointing at the most recent
  Activity Seen, and there would be no proof of the order of the two.
  Reordering the two might cause different results though.

  This is not only a problem when 2 developers are connected; it also
  lets a single developer produce a proof chain that is ambiguous about
  what order they entered 2 things.

  Fix: Make a Activity Entered have a pointer to the previous Activity
  Entered that was accepted, in addition to the existing pointer. Then
  when one developer sends two Activity Entered that don't echo, there's
  still proof of ordering. When two developers are typing at the same
  time, only one of their inputs will be accepted. The client should only
  consider an Activity Entered legal if it points to the last Activity
  Entered that the client saw.

  May as well make Activity Seen have a pointer to the last accepted
  Activity Entered as well. This will make it easier when supported
  multiple developers, as each time a developer gets an Activity Seen,
  they can update their state to use the Activity Entered that it points
  to.
* --watch and --download only get Seen messages, not Entered messages,
  because the server does not send Developer messages to them.
  To fix, need a way to avoid looping Entered messages sent by a developer
  back to themselves.
* Improve error message when developer fails to connect due to the session
  ID being invalid or expored.
* Use protobuf for serialization, to make non-haskell implementations
  easier?
* Leave the prevMessage out of Activity serialization to save BW.
  Do include it in the data that gets signed, so it can be recovered
  by trying each likely (recently seen) Activity as the prevMessage, and
  checking the signature.
  (If doing this, might as well switch to SHA512, since hash size does not
  matter.)
* loadLog should verify the hashes (and signatures) in the log, and
  refuse to use logs that are not valid proofs of a session.
  (--replay and --graphvis need this; server's use of locaLog does not)
* gpg key downloading, web of trust checking, prompting
  Alternatively, let debug-me be started with a gpg key,
  this way a project's website can instruct their users to
  "run debug-me --trust-gpg-key=whatever"
* How to prevent abusing servers to store large quantities of data
  that are not legitimate debug-me logs, but are formatted like them?
* Multiple developers should be able to connect to a single debug-me
  user and all send Entered messages. Most of the code was written
  with that in mind, but not tested yet..