- update-c{ertdata,cadb}: move bundle creation to functions, fix b64decode
- update-certdata: while OID value was correct, the x-distrusted label was omitted, use pregenerated labels as well
- update-certdata: Found that p11-kit trust does not account for nss-{email,server}-distrust-after values - workaround with explicit distrust for now