Implement Zfa.

This passes our developer test suite, when comparing output
(signature) against the SAIL implementation.

If any corner-cases require additional changes after ACT goes
upstream, we can apply an add-on patch.