Ensure that superfluous signatures are saved in the database

[andywer]

Background: Signers, weights and thresholds might change while a transaction is pending (unlikely, but possible). We should therefore always save all signatures and only on submission decide which ones to include; see #10.

Should only allow a fixed maximum number of signatures, though, to prevent a denial-of-service attack vector.