Add API to check certificate chain signatures

Add hidden API to check certificate chain signatures when needed. The
getCertificates implementation returns a list of all the certificates and
chains and would expect any caller interested in verifying actual chains
to call getCodeSigners instead.

We add this hidden constructor as a stop-gap until we can switch callers
over to getCodeSigners.