DANE TAs via CA PKI by massaging the input chain
Initial code review complete.

Since the child certificate's authority key identifier extension
can impose the serial number, subject keyid, subject name and issuer name
of the wrapped certificate, the only degree of freedom we have left is to
set our own authority keyid extension to specify an authority issuer name,
serial number or keyid that is distinct from ours.  The keyid is simplest.

Added more comments, explaining the overall logic.
Documentation and comments.

Also moved callback set/unset interface to end of file, to facilitate
bottom up reading.