* Audit: private temp paths for the signing certificate and testkit output; confine web font licences to the checkout * testkit: refuse a pre-made private temp directory this user cannot write to