if JCE is used to verify a CRL then we need to find suitable SecurityProvider

since we do not know which security providers are registered we need to
find one which can verify a CRL against its public key. just try
all registered until it either succeeds or fails with a SignatureException.

fixes #20

Sponsored by Lookout Inc.
make sure empty object can be serialize via to_pem

this is mainly to match the specs/tests for the edge case that
the CRL or PKCS10Request are empty object (created with new and without
data)

fixes #19

Sponsored by Lookout Inc.