4S Secrets should be sent as part of the device verification exchange, not afterwards

Suppose a user has two devices, A and B. A is already verified and has access to the 4S secrets (private cross-signing keys, backup decryption key, etc).

Currently, if you perform an interactive verification between the devices, then once verification is complete, B must request the secrets from A, and wait for A to send them. This is problematic because the verification process isn't really "complete" until those secrets have been received, yet we may have to wait an unbounded amount of time for them to arrive.

(B must also wait for A's cross-signature to propagate: again this can take an unbounded amount of time.)

It would be much more robust if:

• B indicated which secrets it expects early in the verification exchange (possibly even indicating the public keys), so that we can warn the user early on if some secrets are going to be missing
• A sent the secrets within the verification exchange itself (part of the done message?)

The issue names no files, tests, or specification sections. Start by locating the interactive verification exchange and existing 4S secret-sharing flow in the Matrix specification; define the request and response semantics, including missing secrets, and document clear completion criteria.