ActivateProtocolVersion cannot be signed with a delegated transaction

ActivateProtocolVersion.Validate expects the principal to match the node URL. Since executor v2 always runs Validate on transactions (unlike v1 that didn't run it on initial submission if the signature was remote), ActivateProtocolVersion cannot be signed with a delegated signature (unless the delegate was somehow on the DN).