The TCPVal uses a SecretConnection over TCP, but does not currently authenticate the connection against a known node ID.

For the TCPVal, we need to:

• persist (and encrypt) the TCPVal.secretConnKey

For the RemoteSigner (and any KMS implementation), we need to:

• format address to dial as ID@host:port or ID@tcp://host:port
• authenticate the dialed ID against the remote ID from the SecretConnection

Replaces part of #2549