X509: simplify cert type selection logic in CertificateSigningRequest
X509: add method to validate the purpose of a certificate