Allow enforcing a minimum `notBefore` date and/or maximum `notAfter` date per trust anchor

[briansmith]

As the title says.

This is related to #29.

We might need different limits for end-entity and intermediate certificates.