pkg: pull rsa bits out of pkg.c

We'll eventually add a pkgsign abstraction over these similar to how we do
in pkg(8), but start by isolating these parts.

Reviewed by: bapt, emaste

(cherry picked from commit 2629e90dd05fb69d767525f960101d7d055ffae0)