Validate lockboxes

I don't think there's currently anything stopping me (at the graph level) from adding a lockbox for someone else. For example, I could make a fake lockbox containing user keys, addressed to someone else's device. I haven't thought through what the consequences of that might be -- it's not immediately clear how I might use that to my advantage. But it's probably not great, so should lock that down. 