more work on #6: use SEC_PKCS7Encode instead of SEC_PKCS7EncodeItem