Replaces previous issue #1146. See extensive discussion there.

A previous PR (#1615) implemented a proposer based time that would change Tendermint's liveness guarantees. Instead, we should revert to the original design of using the median from timestamps in precommits. The downside is that timestamps in precommits means we can't aggregate signatures, but we can reassess when we're ready for signature aggregation (sometime in 2019).

There is a spec.

We should consider recovering some of the changes from #1615

• various comment fixes
• time.Now().Round(0).UTC() for all calls to time
• Use time.RFC3339Nano (types: canonical time should use RFC3339Nano #2037)