Fix digest handling after 5ae680e49

This adds a sha256_fd() and fd support to rsa_verify(). This allows
passing the temporary fd directly to these functions to check
the signature. sha256_file() is now a wrapper around sha256_fd().
(nop) Use proper order to lseek()