Allow to to load the CA chain directly from memory instead of

Allow to to load the CA chain directly from memory instead of
specifying a file.  This enables CA verification in privsep'ed
processes that are running chroot'ed without direct access to the
certificate files.

With feedback, tests, and OK from bluhm@