Check that KDM validity periods are safely within the validity periods

Check that KDM validity periods are safely within the validity periods
of the signing certificate chain.

This does cause problems when you try to create a KDM for a certificate
you just made (due to the fact that certificates always have a start-valid
time of "now") but hopefully this can be fixed up in another commit.