refactor delegate script to use separate witnesses

[lenkan]

This illustrates the issue encountered in #975 and adds the steps needed to resolve it.

I have added some utility functions to make it easier to create isolated keystores and avoid creating config files for each AID. Please advice if you like this approach.

Closes #975