Be picky about having a signer's der data, not just an empty reference.

When NSS sees an issuer cert it doesn't know about, it builds an entry
for it in its internal cache, but the DER blob isn't populated unless it
sees an actual copy of the cert.  So we shouldn't try to emit that blob
in that case.

Signed-off-by: Peter Jones <pjones@redhat.com>
Add RHEL bits to %%pesign macro.

Signed-off-by: Peter Jones <pjones@redhat.com>
Rework certdb's add_db_cert and check_db functions.

Signed-off-by: Peter Jones <pjones@redhat.com>
Unhide --padding from documentation.

Signed-off-by: Peter Jones <pjones@redhat.com>
reformat trailing whitspace and linebreaks in %%pesign.

Signed-off-by: Peter Jones <pjones@redhat.com>
Actually build peverify.

It doesn't /work/ yet, but from here on out it should at least compile.

Signed-off-by: Peter Jones <pjones@redhat.com>