Time

Plug in time verification.

Make it optional in the name of determinism, and the fact that not all call-sites that would want to check some certificates have time to provide.

Also did not check Private Key Usage Period extension, because, according to **RFC3280**:

```
4.2.1.4  Private Key Usage Period

   This extension SHOULD NOT be used within the Internet PKI.  CAs
   conforming to this profile MUST NOT generate certificates that
   include a critical private key usage period extension.
```