New sanity check: maximum certificate lifetime

Prevent generation of issued certificates which have an expiration date
greater than the certificate authority's expiration date.

Add option --force to bypass this check

Document and improve documentation for related items