Specs have outside dependencies

The specs as they exist depend on external sites, and should instead be rewritten to use a purpose-made CRL, and either a mock OCSP endpoint or a bundled and predictable OCSP endpoint.

This PR adds a CA generator and an OCSP/CRL server (that has to be started manually).