Implement the ability to whitelist certs from specific issuers

net/cert/cert_verify_proc.h

Index: net/cert/cert_verify_proc.h
diff --git a/net/cert/cert_verify_proc.h b/net/cert/cert_verify_proc.h
index f60ed6d9232631f1ae2e0fcefb27a373bfe20d08..482d771c5b9dcda9b7a746181e3c8e1b09f604a8 100644
--- a/net/cert/cert_verify_proc.h
+++ b/net/cert/cert_verify_proc.h
@@ -112,6 +112,12 @@ class NET_EXPORT CertVerifyProc
   // (i.e. by 1 July 2019).
   static bool HasTooLongValidity(const X509Certificate& cert);
 
+  // IsNonWhitelistedCert returns true iff the issuer of |cert| (as contained
+  // in |hashes|) has been constrained to a whitelist of subject certificates,
+  // and |cert| is not in that whitelist.
+  static bool IsNonWhitelistedCert(const X509Certificate& cert,
+                                   const HashValueVector& hashes);
+
   DISALLOW_COPY_AND_ASSIGN(CertVerifyProc);
 };