Allow intermediate CAs to pass verification if in CA store.

- If an intermediate CA is the last in a chain and is
  present in the CA store, the chain will now be verified
  instead of rejected with an unknown CA error.
- Did some refactoring of verifyCertificateChain to clarify
  when certificates are self-signed and to ensure self-signed
  cert signatures are checked and that they enter the keyUsage
  and other extension checking code path.