Allow the TrustStore interface to return matching intermediates, and identify distrusted certs.

net/cert/internal/cert_errors.cc

Index: net/cert/internal/cert_errors.cc
diff --git a/net/cert/internal/cert_errors.cc b/net/cert/internal/cert_errors.cc
index be4814dc9c62fbf6de21ee591affa23cad2afdb0..8d38e3c849049733ac611b89d3f13d5f29fb020b 100644
--- a/net/cert/internal/cert_errors.cc
+++ b/net/cert/internal/cert_errors.cc
@@ -171,11 +171,8 @@ std::string CertPathErrors::ToDebugString(
     if (cert_errors_string.empty())
       continue;
 
-    // Add a header for the CertErrors that describes which certificate they
-    // apply to.
-    //
-    // TODO(eroman): Show the subject for trust anchor (which currently uses the
-    // bucket cert_errors_[certs.size()]).
+    // Add a header that identifies which certificate this CertErrors pertains
+    // to.
     std::string cert_name_debug_str;
     if (i < certs.size() && certs[i]) {
       RDNSequence subject;