Still need tests for trusted-first and tests that probe construction of alternate chains. Reviewed-by: Richard Levitte <levitte@openssl.org>