Support expiration dates on stapled certifications

[JeremyRand]

We should support expiration dates, like we did in namecoin/encaya#62.

SSH CA's don't have built-in expiration dates, so we'd have to enforce the date check on Encasha's end (which should not be particularly difficult).