Merge PR #2800: Limit total number of signatures per transaction

* Limit total number of signatures per transaction
* Fail if limit is exceeded
* Loop over all sigs and count subkeys
* No need for a type switch, adopt early return
* Test rejection logic
* Mention sigs limit

docs/reference/baseapp.md

@@ -2,8 +2,7 @@
 
 `baseApp` requires stores to be mounted via capabilities keys - handlers can only access stores they're given the key to. The `baseApp` ensures all stores are properly loaded, cached, and committed. One mounted store is considered the "main" - it holds the latest block header, from which we can find and load the most recent state.
 
-`baseApp` distinguishes between two handler types - the `AnteHandler` and the `MsgHandler`. The former is a global validity check (checking nonces, sigs and sufficient balances to pay fees,
-e.g. things that apply to all transaction from all modules), the later is the full state transition function.
+`baseApp` distinguishes between two handler types: `AnteHandler` and `MsgHandler`. Whilst the former is a global validity check that applies to all transactions from all modules, i.e. it checks nonces and whether balances are sufficient to pay fees, validates signatures and ensures that transactions don't carry too many signatures, the latter is the full state transition function.
 During CheckTx the state transition function is only applied to the checkTxState and should return
 before any expensive state transitions are run (this is up to each developer). It also needs to return the estimated
 gas cost.