Bind the HSS and XMSS^MT private key indices to the traversal state stored beside them, cross-check the XMSS and XMSS^MT root against the BDS state's own copy, carry a checksum over the encoded BDS state bound to the owning key's public seed since its node values cannot be recomputed cheaply, and regenerate the byte-level format documents the state change moves, relates to github #2414.