validate given trust anchors (fail early!)