Fix a bug in the modified purpose code: it wasn't updated to use the

new purpose getting function.

Update the ca-cert.pem and pca-cert.pem "CA" certificates so they
really are CA certificate: that is they have the appropriate extensions.