Improve wrap_key and wrap_cert.

Bugfix: wrap_cert() and wrap_key() should never fail, and some calls
ignored the return value.  They only fail for lack of memory, use
msg_fatal() internally and change them to return void.

Bugfix: Avoid making DANE certificates with replaced public-keys
appear self-signed.