swap util functions
don't force last cert in chain to self-sign
totality
reverse private parsed certificates

In pems, chains go top-down.