fn ensure_root_sender(actual: Address, expected: Option<Address>) -> Result<()>
Ensures AccountKeychain calls with a known root account use that root as the signer.