Full support for out-of-band trust anchor certs and public keys.
Adapt trust-anchor support to new interface.