Restoration is fragile

[Hamms]

Three issues:

1. There are a handful of ways for the restoration process to break, given bad inputs
2. There are a handful of things we'd like to raise warnings about in the restoration (ie mismatching sets of redactions) and we do not currently have a good way to do so
3. Restoration does not currently protect against the introduction of things that should be redacted in the modified redacted input