add PKI verification routines
default value for CVMFS_TRUSTED_CERTS
add client parameter CVMFS_TRUSTED_CERTS
check full pkcs7 structure, not just detached signature
support for trusted certificate directory in replication