Make the OCSP verification more robust.

Previous code relied on on having certificates from getCertificates() in
certain order, even though the documentation said the array is "in no
particular order".

Instead, use getSignCertificateChain(), which is guaranteed to return
ordered chain starting with the issuer.