Address @jkroll-cf's feedback on keycache interface.

+ persistLabels moved from cryptor to persist package global.
+ Restore now explicitly checks for the case where there aren't enough
  shares to return `ErrRestoreDelegations`.
+ The users responsible for restoring the cache are now logged.

msp/msp.go

@@ -211,6 +211,10 @@ func (m MSP) DistributeShares(sec []byte, db UserDatabase) (map[string][][]byte,
 	return out, nil
 }
 
+// ErrNotEnoughShares is returned if there aren't enough shares to
+// decrypt the secret.
+var ErrNotEnoughShares = errors.New("Not enough shares to recover.")
+
 // RecoverSecret takes a user database storing secret shares as input and returns the original secret.
 func (m MSP) RecoverSecret(db UserDatabase) ([]byte, error) {
 	cache := make(map[string][][]byte, 0) // Caches un-used shares for a user.
@@ -225,7 +229,7 @@ func (m MSP) recoverSecret(db UserDatabase, cache map[string][][]byte) ([]byte,
 
 	ok, names, locs, _ := m.DerivePath(db)
 	if !ok {
-		return nil, errors.New("Not enough shares to recover.")
+		return nil, ErrNotEnoughShares
 	}
 
 	for _, name := range names {