Sego: Pervasive Trusted Metadata for Efficiently Verified Untrusted System Services