verifier: 5280 compliance #429

The verifier currently implements a very minimal check over the cert chains from the RoT. Currently it checks signatures over the cert chain, and verifies that the chain is rooted in our platform identity pki but that's it. We need to add all of the other checks required by RFC 5280 & the policy extensions that we add.