Add sanity checks for malicious challenges

[TheZ3ro]

Right now we don't perform any sanity checks on challenges coming from the server.
This is obviously bad but it's a PoC and we like to be brave.

This issue is a reminder to add some kind of checks (or to add a comment to remind that we should eventually add checks) at line https://github.com/lsd-cat/securedrop-poc/blob/main/source.py#L68

[TheZ3ro]

This is still a valid issue even though line number reported by OP is not meaningful anymore

[lsd-cat]

This should no longer apply as we phased out the use of inverted keys and the client does not send anymore a "response" to the challenges, rather decryption happens locally.

[lsd-cat]

Confirmed the assessment, this issue is no longer applicable thanks to the protocol contribution from @eaon and the subsequent merging of #17.