expands spaces
reorg
require certificate 1.3.5
check that a certificate has the ability to actually sign another certificate.

this is done basically by verifying that the CA is set in basic constraints,
and then that the key usage allow certificate signing.
bump version
bump version of extra's dependencies debug.
bump version