validate signatures before importing trust anchors

stats: read 159 certificates, could validate 133 (taken from nss and cacert) :)
(others due to ECC/hash algorithms other than md5 & sha1)