Noteworthy changes 0.8.0
========================

* INCOMPATIBLE CHANGE, backups made by earlier C clients cannot be
  recovered; the cause is some incongruence between the C and
  TypeScript implementation where the C code had the KDF wrong which
  was now resolved.

  Recovery of such a backup fails with "failed to decrypt policy document
  with the given identity attributes".  There is no way for the client to
  tell that case apart from genuinely mistyped identity attributes, since
  the ciphertext looks the same either way -- the message names both
  possibilities for that reason. Using an older client should still allow
  recovery of the older backup.

* The provider REST API is now at protocol version 2:0:1.  Clients that
  advertise protocol version 0 (i.e. anything predating the key derivation
  change above) are refused.

* libanastasisutil breaks ABI: its soname goes from 0 to 1.  The four
  decryption wrappers (ANASTASIS_CRYPTO_recovery_document_decrypt,
  _keyshare_decrypt, _truth_decrypt and _core_secret_recover) used to be
  void and to abort the process on ciphertext a malicious provider could
  choose; they now return enum GNUNET_GenericReturnValue and the caller has
  to check it.  Out-of-tree users -- notably anastasis-gtk -- must be
  rebuilt, and their call sites adjusted.

* Providers upgrading an existing database must run anastasis-dbinit to pick
  up the stasis-0002 migration; it replaces the challenge-code index with
  one garbage collection can actually use.

