Refactor expiration calculation

Refactor expiration calculation

Unify common code paths which find the exact expiry moment into a new
helper function. Additionally, the new helper offers more accuracy by
checking more applicable CRLs whether their 'nextupdate' is 'sooner'.

tb@ noted: The helper adds a multiplier of log(#crls), but that's
certainly acceptable as it is still very cheap.

OK tb@