Walk the trust chain for PKIXCD

[ashdwilson]

Current implementation only goes one level deep for retrieving CA certificates.

Desired behavior:

• If a retrieved CA certificate is not a root certificate then the AKI will be used to query for the parent CA certificate.
• Parameterize the number of queries we are willing to make to get to the ultimate trust anchor. Default to 2. Raise an exception if the configured query limit is insufficient.
• The CA certification chain will be represented as an aspect of the Identity, so that the application may easily retrieve and store the cert chain.
• The root certificate for an identity will be made available independent from the rest of the trust chain.