Start a Kyber vault.

Signup stays in the auth plane. The main app only receives a signed session after the auth service has finished the flow.