It's important that group messages be signed by the sender, rather than by a
secret derived from the shared secret.

To make sure that we don't sneakily use methods which we wouldn't be able to
for remote users, expose an interface object which contains the remote
interface.