Allow the TrustStore interface to return matching intermediates, and identify distrusted certs.

components/cast_certificate/cast_crl.cc

Index: components/cast_certificate/cast_crl.cc
diff --git a/components/cast_certificate/cast_crl.cc b/components/cast_certificate/cast_crl.cc
index 7d866e370884982d920e4c4285217fe5d2f323ed..e8e0595892d7642602efadc9acb979e143f9a376 100644
--- a/components/cast_certificate/cast_crl.cc
+++ b/components/cast_certificate/cast_crl.cc
@@ -70,10 +70,7 @@ class CastCRLTrustStore {
             kCastCRLRootCaDer, sizeof(kCastCRLRootCaDer), {}, &errors);
     CHECK(cert) << errors.ToDebugString();
     // Enforce pathlen constraints and policies defined on the root certificate.
-    scoped_refptr<net::TrustAnchor> anchor =
-        net::TrustAnchor::CreateFromCertificateWithConstraints(std::move(cert));
-    CHECK(anchor);
-    store_.AddTrustAnchor(std::move(anchor));
+    store_.AddTrustAnchorWithConstraints(std::move(cert));
   }
 
   net::TrustStoreInMemory store_;
@@ -261,7 +258,7 @@ bool CastCRLImpl::CheckRevocation(const net::CertPath& trusted_chain,
   if (trusted_chain.IsEmpty())
     return false;
 
-  DCHECK(trusted_chain.trust_anchor);
+  DCHECK(trusted_chain.last_cert_trust.IsTrustAnchor());
 
   // Check the validity of the CRL at the specified time.
   net::der::GeneralizedTime verification_time;
@@ -274,17 +271,10 @@ bool CastCRLImpl::CheckRevocation(const net::CertPath& trusted_chain,
     return false;
   }
 
-  // Check revocation. Note that this loop has "+ 1" in order to also loop
-  // over the trust anchor (which is treated specially).
-  for (size_t i = 0; i < trusted_chain.certs.size() + 1; ++i) {
-    // This loop iterates over both certificates AND then the trust
-    // anchor after exhausing the certs.
-    net::der::Input spki_tlv;
-    if (i == trusted_chain.certs.size()) {
-      spki_tlv = trusted_chain.trust_anchor->spki();
-    } else {
-      spki_tlv = trusted_chain.certs[i]->tbs().spki_tlv;
-    }
+  // Check revocation. This loop iterates over both certificates AND then the
+  // trust anchor after exhausting the certs.
+  for (size_t i = 0; i < trusted_chain.certs.size(); ++i) {
+    const net::der::Input& spki_tlv = trusted_chain.certs[i]->tbs().spki_tlv;
 
     // Calculate the public key's hash to check for revocation.
     std::string spki_hash = crypto::SHA256HashString(spki_tlv.AsString());