verified structure can contain its own CRLs (such as PKCS#7 signedData). Tidy up some of the verify code.