pkg: abstract rsa out behind a pkgsign API

This mirrors a change we made in pkg(8), and will be used to next add
another signer that does ECC.

Reviewed by: bapt, emaste

(cherry picked from commit 5862580ded35e23581291a2e1052f04428369ead)