Added script header informations
Force encryption for root and intermediate CAs

The option for a CA without a challenge is now restricted to a
signing-ca. Any other try will result in an error.
Small fixup when using --root-ca and --sign-with

The sign-with option will now be ignored when creating a root-ca
Keeping logic simple
Using password files for OpenSSL

All helper scripts accepts now as argument a file which contains the
password to encrypt and decrypt the private key of CA.
The wrapping script build-ca.sh asks for needed passwords and stores
them in temp files. These files will be shreded after using.
This reduces the amount of passwords to be asked for.
Paranoid users can use a switch in the build-ca-sh script to avoid
saving the password in a temp file.
Support for certification bundles

Some software eg nginx needs a pem file including the crt of the
certificate to use and the informations about the ca-chain.