add runcmd infrastructure, delete old foreign-signed-function
restructuring + subfunctions
more cert logic