Ping @Dominic, can we get this into ssb-validate (see post above for a regex that rejects invalid box suffixes)? If js ssb doesn't enforce this, having it in some written spec doesn't really matter at this point.

CC @keks