rpmdb_pubkey: more bounds checking