CertVerifyProcMac: Add Keychain re-ordering hack, check CRLsets in path pruning loop.

net/data/ssl/certificates/README

 This directory contains various certificates for use with SSL-related
 unit tests.
 
 ===== Real-world certificates that need manual updating
 - google.binary.p7b
 - google.chain.pem
 - google.pem_cert.p7b
 - google.pem_pkcs7.p7b
 - google.pkcs7.p7b
 - google.single.der
@@ skipping 40 matching lines @@
      embedded SCTs, followed by the issuer certificates chain.
      All files are from the src/test/testdada directory in
      https://code.google.com/p/certificate-transparency/
 
 - comodo.chain.pem : A certificate chain for www.comodo.com which should be
      recognised as EV. Expires Jun 20 2015.
 
 - twitter-chain.pem : A certificate chain for twitter.com which should be
      valid. Expires May 9 2016.
 
+- tripadvisor-verisign-chain.pem: A certificate chain for www.tripadvisor.com
+  issued by VeriSign Class 3 Public Primary Certification Authority - G5.
+  Expires Apr 2 2018.
+- verisign_class3_g5_crosssigned-trusted.keychain: An OSX Keychain set to
+  Always Trust the SHA1 cross-signed version of VeriSign Class 3 Public Primary
+  Certification Authority - G5
+
 ===== Manually generated certificates
 - client.p12 : A PKCS #12 file containing a client certificate and a private
      key created for testing.  The password is "12345".
 
 - client-nokey.p12 : A PKCS #12 file containing a client certificate (the same
      as the one in client.p12) but no private key. The password is "12345".
 
 - unittest.selfsigned.der : A self-signed certificate generated using private
      key in unittest.key.bin. The common name is "unittest".
 
@@ skipping 93 matching lines @@
 
 - reject_intranet_hosts.pem
    A certificate with a non-IANA delegated domain, which is rejected since a CA
    cannot validate the applicant controls that domain.
 
 - pre_june_2016.pem
 - post_june_2016.pem
    Certs to test that policies related to enforcing CT on Symantec are
    properly gated on the issuance date.
 
+- multi-root-BFE.keychain: An OSX Keychain containing the generated
+  certificates "multi-root-B-by-F.pem" and "multi-root-F-by-E.pem".
+
 ===== From net/data/ssl/scripts/generate-weak-test-chains.sh
 - 2048-rsa-root.pem
 - {768-rsa,1024-rsa,2048-rsa,prime256v1-ecdsa}-intermediate.pem
 - {768-rsa,1024-rsa,2048-rsa,prime256v1-ecdsa}-ee-by-
       {768-rsa,1024-rsa,2048-rsa,prime256v1-ecdsa}-intermediate.pem
       Test certificates used to ensure that weak keys are detected and rejected
 
 ===== From net/data/ssl/scripts/generate-cross-signed-certs.sh
 - cross-signed-leaf.pem
 - cross-signed-root-md5.pem
@@ skipping 99 matching lines @@
      aia-cert.pem has a caIssuers that points to "aia-test.invalid" as the URL
      containing the intermediate, which can be served via a URLRequestFilter.
      aia-intermediate.der is stored in DER form for convenience, since that is
      the form expected of certificates discovered via AIA.
 
 ===== From net/data/ssl/scripts/generate-self-signed-certs.sh
  - self-signed-invalid-name.pem
  - self-signed-invalid-sig.pem
      Two "self-signed" certificates with mismatched names or an invalid
      signature, respectively.