System upgrade handling

[Shadowfiend]

Some of the questions this issue can track (until we break it down further, if needed):

• What conditions trigger a “hard fork”-style whole-system upgrade?
• What does a whole-system upgrade consist of? e.g., what happens to the relay and its relay groups? [1] What happens to keeps?
• What do softer upgrades look like (e.g., client upgrades)?

[1]- One concrete question for the relay is, say we want to change the curve on which we run BLS key generation and signing. How do we manage this? In particular, do we require all active relay groups to regenerate their keys post-upgrade? Do we support two curves in parallel? Do we drop all groups and restart the relay? Working out some of the implications of these decisions would be good. Several of them will likely apply to other places as well (e.g., Threshold ECDSA likely will have similar questions about crypto upgrades).