Implement PKI Interface for eID-Server

Implement a PKI interface for the eID-Server to support certificate retrieval, validation, trust anchor management, and signed object verification. This implementation must comply with TR-03129, TR-03110, and ICAO 9303 Part 12.

## Goals
- Enable certificate fetching from BerCA and PKD
- Validate CSCA and signer certificates
- Manage CRLs and trust anchors
- Support passive authentication and blacklist/defect list checks

## References
- TR-03129
- TR-03130 §2.3.3 and §2.4