Refactor the 'sign' module

Most functions have been renamed.  The public key types have been moved
to the 'validate' module (which 'sign' now depends on), and they have
been outfitted with conversions (e.g. to and from DNSKEY records).

Importing a generic key into an OpenSSL or Ring key now requires the
public key to also be available.  In both implementations, the pair are
checked for consistency -- this ensures that both are uncorrupted and
that keys have not been mixed up.  This also allows the Ring backend to
support ECDSA keys (although key generation is still difficult).

The 'PublicKey' and 'PrivateKey' enums now store their array data in
'Box'.  This has two benefits: it is easier to securely manage memory
on the heap (since the compiler will not copy it around the stack); and
the smaller sizes of the types is beneficial (although negligibly) to
performance.

Cargo.toml

@@ -49,11 +49,10 @@ tracing-subscriber = { version = "0.3.18", optional = true, features = ["env-fil
 default     = ["std", "rand"]
 bytes       = ["dep:bytes", "octseq/bytes"]
 heapless    = ["dep:heapless", "octseq/heapless"]
-openssl     = ["dep:openssl"]
 resolv      = ["net", "smallvec", "unstable-client-transport"]
 resolv-sync = ["resolv", "tokio/rt"]
 serde       = ["dep:serde", "octseq/serde"]
-sign        = ["std"]
+sign        = ["std", "validate", "dep:openssl"]
 smallvec    = ["dep:smallvec", "octseq/smallvec"]
 std         = ["bytes?/std", "octseq/std", "time/std"]
 net         = ["bytes", "futures-util", "rand", "std", "tokio"]