Serialize: identifier (2 bytes, big-endian), (gt-1)<<4 | (gc-1),
gi<<4 | (mt-1), mi (reserved high nibble zero), then the value.
The reference's serializer is private and only ever sees fields from a
validated spec; this public one validates the object instead.
InvalidParameter for a non-object, a header field
outside its width or a value that is not a Secret;
GroupThresholdInvalid when groupThreshold > groupCount.
Serialize: identifier (2 bytes, big-endian),
(gt-1)<<4 | (gc-1),gi<<4 | (mt-1),mi(reserved high nibble zero), then the value. The reference's serializer is private and only ever sees fields from a validated spec; this public one validates the object instead.