Fernet signing & verification

Not tested at all yet since the API is not compatible with Kensa due to the API's requirement of a `--name` option on provisioning.