Make the DFO Protocol resilient

[eflumerf]

One of the items identified in the Application Framework Review Workshop was that the DFO is a single-point-of-failure in the system. We should revise the DFO protocol so that multiple DFOs can be run in concert, and they achieve consensus about each decision in some manner (preferably with very low latency). The chosen pattern could then be extended to other vulnerable points in the system (such as the MLT).