But if Share begin to enforce this, then code like

  d = Share(self, share.field, (share.field(id), share))

will break. Here we actually do want Share to temporarily hold a value which is
not in the field. This is because a list of these shares are passed to
Runtime._recombine -- the problem might very well be that _recombine should not
expect such a list.

The Share constructor should accept either a field *or* a value, not both. When
a value is given the field is redundant and it leads to code like this:

  a = Share(runtime, Zp, Zp(a_value))

which looks strange.