v1.2: ca/: a sample PKI, 3-level CAs

Based on https://pki-tutorial.readthedocs.io/en/latest/expert/index.html

Changes: bits: 4096 - that's good for decades
Default MD: sha512, even if sha256 is fine