Signed Kext Requirement

Creates a new requirement that dictates packages are unable to install due to requiring a signed kext to function. Things that depend on osxfuse aren’t revisioned because there’s a signed upstream binary package available now. 

Everything that relies on tuntap is revisioned because there is no signed upstream binary and people should immediately migrate to using Tunnelblick, Viscosity, Cisco or some other VPN provider who ship signed binaries. Anything that relies on tuntap in Yosemite stable is likely to fail soon if it hasn’t already.

Anything that depends on fuse4x likewise is revisioned because there’s no upstream binary available and they need to seek out alternative software that will function on Yosemite.

Discussed this with @mikemcquaid earlier, so hopefully this is along the lines of what he had in mind and Mike doesn't think I've lost the plot too much :wink:.
Alright. How should I work this requirement then? Presumably we want to include a version check so we don't have to do the ``` => :mavericks ``` thing on every formulae involved, but we want to scope that to just 10.10 inside the requirement.