Validate new root cert against trust pinning

[endophage]

When a new root cert is being rotated in, validate that is passes the current trust pinning. This will help ensure the currently available trust pinning information is correct and new users will be able to trust the new root key.

If it fails to validate. Fail the rotation with an message that makes it obvious what the issue is.