Changes

* create srpVerifier from srpPW and srpSalt (as described below)

* deliver (email, stretchParams, mainSalt, srpParams, srpSalt) to the keyserver's createAccount() API

To limit abuse, the createAccount() should also require a fresh "createToken". This should be created by some other API, outside the scope of this document, that perhaps requires a CAPTCHA or something. createAccount() might also require a proof-of-work token, as described below.

After creating the account, the client immediately runs getToken("sign"), as described below, to fetch kA and wrap(kB). It then unwraps wrap(kB) by XORing it with wrapKey to obtain kB.

= Email+Password -> SignToken/ResetToken =