adds BasicConstraints checking

ensure BasicConstraints exists and are CA:TRUE for all signing/issuer certs in chain.

also small optimization of only loading StrongTrustManager once