pki_crypto: guard against NULL pubkey->rsa in signature extraction