Serialize sign calls that require auth prompt (#776)

[razmser]

Newer Secure Enclave authentication requests cancel any in-flight request. When multiple signing requests arrive concurrently for the same protected key, this results in overlapping authentication prompts and causes all but the most recent request to fail.

This change serializes authentication requests so that:

• Only one Secure Enclave authentication prompt is active at a time
• Additional signing requests are queued while authentication is in progress
• Queued requests are processed in order once authentication completes

Fixes: #532

[Mic92]

Just noticed this fix is quiet similar to mine: #780

[Mic92]

But my pull request is not doing that, so your version might be better.

[Mic92]

Friendly ping @maxgoedjen
Usually I would just pull the patch and call it a day, but my key is bound to your signed package...

[Mic92]

@maxgoedjen another ping for review.

[maxgoedjen]

Sorry about the delay on this one - I'm kinda skeptical this is the way we ought to be going... I thin the right solution here is probably some mix of config (keeping connections on) on the SSH side and possibly some sort of improved batching U (like, get prompted to approve all of them)? Let me think this one through a little more.

[razmser]

config (keeping connections on) on the SSH side

Keeping connections open on the SSH side makes sense, but the issue here is establishing them for the first time.

The only way I see batching to work is detecting that we already have pending request(s) and calling a sign with pending + current.

PS. Persistent authentication helps here because we can SSH once and persist it. But the only way I found out about it was by reading the code.