Proper certificate validation

[cyraxx]

Currently, we're validating that a claim's signature is valid and matches the certificate's public key. We also check the certificates for semantic validity (such as key usage parameters).

However there are no checks regarding the trustworthiness of the certificate. This needs a couple of things:

• Validate the certificate chain. This should be straightforward using @PeculiarVentures/x509 or pkijs functions, it will just need some work to ensure our custom Crypto is used instead of web crypto.
• Match the certificate chain against a trust store. This could be the temporary C2PA trust list or a custom one.
• Implement OCSP checks.
• Do the same for signed timestamps.

[cyraxx]

Signature.ts is using a mixture of @PeculiarVentures/x509 and pkijs, this should be rectified to only use one of them.

pkijs is probably the more complete option that offers a lot of functionality out of the box. For instance, it would allow us to completely remove the Signature.verifySignedDataSignature() method and call the built-in signedData.verify() instead. It just means that we need to write a CryptoEngine adapter to ensure portability.

[cyraxx]

Keep in mind that this also means supporting more signature algorithms than we currently do in our Crypto. Chain certificates could be using all sorts of signatures and hashes.