libp2p: Gossipsub StrictSign accepts attacker-signed messages as a victim RSA peer ID

Summary @libp2p/gossipsub StrictSign validation does not bind a supplied message public key to the claimed from peer ID when from is an RSA-style peer ID that does not inline its public key. An attacker can set from to a victim RSA peer ID, sign the message with the attacker's own private key,...