vantagectl/Dockerfile follows the repo's per-module convention rather than living under deploy/docker. verify's live check needs AES-GCM open, so the cipher primitives move to shared/cryptobox and services/crypto.go delegates, rather than a second copy of the cipher existing in another module.