DANE TAs via CA PKI by massaging the input chain

With OpenSSL 1.0.2 (under development) trusted certificates don't
need to be self-signed roots.  This feature can be detected via the
associated new X509_V_FLAG_PARTIAL_CHAIN flag.  Otherwise (1.0.1
or earlier), we need a chain that ends in a traditional self-signed
root CA.  So, trust-anchor wrapper certificates must be signed for
now, but we don't know the private key, so they can't be self-signed.

To this end we need an internal root CA key.  Since the subject
certificate signed by a TA public key can specify the *parent's*
issuer via the "issuer" element of an authority key identifier
extension, the root CA that issues TA certs cannot itself be fixed.
Thus we generate both the TA and the signing root CA cert on the
fly.

Since the child certificate's authority key identifier extension
can impose the serial number, subject keyid, subject name and issuer
name of the wrapped certificate, the only degree of freedom we have
left is to set the TA certificate's authority keyid extension to
specify an authority issuer name, serial number or keyid that is
distinct from that of the TA.  The keyid is simplest.