Handle case where a validator isn't ready for signer rotations

[JesseAbram]

Edge case of not enough validators for signer rotation, currently handled by not allowing them to rotate (probably should also force a proactive refresh)

[ameba23]

Not sure if this is the right issue to discuss this, but re: the proposal of not letting a current signer leave if the validator set is too small to have someone else to replace them:

I guess this should never happen if we as an organisation run a number of validators ourselves which is greater than n.

But for the case that for some reason the active ones go down because of some attack, i guess we should be ready to deploy some more to allow members of the signing committee run by others to leave if they want to. Its is a really undesirable situation to have people holding keyshares who want to leave but can't.