Changing, and hopefully simplifying, the ConsistentObjectFetcher logic. Fixing a bug: making sure that when falling back to using a cached manifest, we also use the exact CRL (by hash) for that manifest.
Of course... a self-signed certificate should not include CRL pointer