p11-kit-trust: investigate whether CKA_NSS_{SERVER,EMAIL}_DISTRUST_AFTER can be used
p11-kit now supports the CKA_NSS_{SERVER,EMAIL}_DISTRUST_AFTER
PKCS#11 option. We should investigate where in the PKCS#11 validation this fits, and how we should use it.