Add test for callback and bad signatures
Add test for callback and bad signatures

Our current behaviour is a bit inconsistent here:
- when the bad signature is made by a trusted CA, we stop here and don't
  include the trusted CA in the chain (don't call vrfy on it)
- otherwise, we just add NOT_TRUSTED to the flags but keep building the chain
  and call vrfy on the upper certs

ARMmbed/mbedtls,ARMmbed/mbedtls,NXPmicro/mbedtls,Mbed-TLS/mbedtls,ARMmbed/mbedtls,NXPmicro/mbedtls,Mbed-TLS/mbedtls,NXPmicro/mbedtls,Mbed-TLS/mbedtls,NXPmicro/mbedtls,ARMmbed/mbedtls,Mbed-TLS/mbedtls