Move peer chain security checks into x509_vfy.c