Add initial work to validate cert chain, fix actual scanning