This ticket was spun off from SERVER-27768.

As described in that ticket, the key the mongos and mongod will use to verify the clusterTime will be generated by the config server primary during transition to primary. It will be stored in the admin.system.keys with the following format:

{
    _id: 'clusterTimeKey',
    key: <secure pseudorandom 20 byte key generated by TimeProofService::generateRandomKey()>
}

mongod & mongos behavior:

1. After startup, read the key document from config
2. Initialize TimeProofService with the key
3. Attach TimeProofService to LogicalClock

special for config server:

1. After becoming primary, upsert the key document as described above

The key will be fetched from the config server through a new method on the ShardingCatalogClient, and the key will be stored on the config server through a new method on the ShardingCatalogManager.