Wrapper certificates must be signed for now.

With OpenSSL 1.0.2 (under development) trusted certificates don't
need to be self-signed roots.  This feature can be detected via the
associated new X509_V_FLAG_PARTIAL_CHAIN flag.

Otherwise (1.0.1 or earlier), we need a chain that ends in a
traditional self-signed root CA.  To this end we need an internal
root CA key.  Since the subject certificate signed by a TA public
key can specify the *parents* issuer via the "issuer" element of
an authority key identifier extension, the root CA that issues TA
certs cannot itself be fixed.  Thus we generate both the TA and the
signing root CA cert on the fly.