[DRAFT] Use multiple CAs instead of a single self-signed root CA

[Santti4go]

Ticket #328

I added a new (optional) flag for the create_keystore command: --split-CA
This flag changes the Certificate Authorities structure creating two new CAs (Permissions CA and Identity CA) instead of using the same self-signed root CA with symlinks.
This is an optional flag and does not change default behavior.

More details in the ticket #328

Note

I still need to sign both new CAs with root CA

[fujitatomoya]

i think these kind of new arguments or feature need to be supported in rolling 1st, and then we can consider backport for already released distros including humble.

[Santti4go]

i think these kind of new arguments or feature need to be supported in rolling 1st, and then we can consider backport for already released distros including humble.

Sure, I targeted Humble because it's the branch I'm working on.
If we agree this is a feature we want to add I'll happily target Rolling instead.
WDYT? Do I have green light?

[fujitatomoya]

to be honest, i am not sure. having this optional mode seems to be okay but i do not really maintain this repository. @mikaelarguedas could you take a look or ping someone else here?