Ok, so here's what I'd put into the spec:

• a multibox consists of some cyphertext and a natural number between 0 and 2^64-1 (inclusive) identifiying the crypto (private box has identifier zero)
• clmr encodes a multibox as a VarU64 of the id, followed by the cyphertext length as a VarU64, followed by the cyphertext
• for signing json, private box uses the suffix .box, other ones use .box-<decimal-without-leading-zeros>

Is that alright? @keks, @Dominic, @dinosaur

The js ssb-validate module should change the regex for boxes accordingly.