ca_verify should support multiple CA certs

[garlick]

When the CA cert is updated, the previous one should remain valid for a time.

New cert signings should use the new cert, but certs signed by the old CA cert should remain valid until they expire.

So perhaps the CA pub key should be stored in a file named for its uuid, and verification should use the "issuer" metadata to map to the CA pub key that should be used for verification.