Probably useful for implementation later.
Useful for test suite right now.

Helpful for the tests

We do so by introducing a limitation that the client must be configured with
an issuer and it must match the issuer announced by any storage server the
client is to talk to.

The client will decline to speak to any storage server without a matching
issuer.

lots of mess to clean up though

Passes cannot be constructed until we know how we're going to use them since
they are derived from the unblinded tokens and an operation-specific message.

We can put a plugin here later.