Require that binary decoding leaves no leftovers
    
    When decoding a PKCS#7 signed-data or certificate, reject a result if a
    successful decode leaves us with trailing binary data that isn't parsed,
    just in case the sender's trying something malicious.