Fix certificate chain and signature validation

I wanted to get this done before tomorrow, but the KJUR library might be the worst thing ever written. All of the documentation is out of date, and there is no way to get the certificate's signatureAlgorithm and signatureValue from the x509 certificates. Until we can do this, we won't be able to validate the chain. I've been reading up on the x509 and asn1 specs, but it might be a while until I fix this.

This also fixes an issue with Root Cert checking.

This totally blindsided me. We probably won't get payment protocol out *with* the proper cert chain validation until next week, unless I figure it out tonight.

The x509 spec specificies that a certificates signature is a string of bytes appended to the cert, but obviously the cert could not contain the sig when the signature is created. There should be a simple way of slicing of bytes from the end based on the signatureAlgorithm but I've yet to figure it out.