After extensive discussion about the light-client, we decided it's much better to get the current validator set to actually sign the next ValidatorSet.Hash by including it as NextValidatorSetHash in the header.

This means that for a ValidatorSetChange returned from the EndBlock of height H, the change will only take place for block H+2. Block H+1 will still have the old validator set, but will include the new NextValidatorSetHash, allowing them to sign it.

This was discussed previously (#377, #1022 ) and rejected for the time being, as the light-client was okay without it so long as the validator set changed by less than 1/3. But we have users that want to allow larger changes - to securely (and conveniently) do so, and to simplify the light-client logic itself, we need the current validator set to sign the new one.