feat(general): verify ECDSA-P256 signatures on external custom checks before loading (#7556)