adds tsa cert chain check for env var or tuf targets. (#3600)

adds tsa cert chain check for env var or tuf targets. (#3600) #7020