Supporting creating and validating cert chains

[yaronyg]

It's bad practice to constantly encrypt with your root key. It puts the key on a network connected process and it uses the key too much thus helping cryptoanalysis. So what we really want to do is have a root key and then follow that with a device key. To do that we need a way for the root key (which is the real identity) to sign the device key. Probably the easiest way to do this is via cert chains. So we need to be able to generate and validate cert chains.