Add `PKG_EVENT_SANDBOX_GET_STRING` event.
Use int64 type for certlen and siglen.
Add loading of certs from meta in sandboxed mode.
Null terminate string read.
Add utility to extract key from meta in sandbox.
Check meta signature.
Set allocated flag for signature key.
Get pubkey from meta if possible.
Verify signatures inside sandbox.
Include config header where needed.
Fix capsicum mode entering.
Add notice about `rsa_verify` deprecation.
Merge branch 'sandboxed-sig-verify'