Client spec: Specify that certificate verification should fail without a signed time source, current time with explicit policy

[haydentherapper]

Description

If neither an RFC 3161 signed timestamp nor a log timestamp (SET) is successfully verified, then certificate verification should fail. Currently, it is not explicitly documented that a client must require at least one successful verification of a signed timestamp.

We should also document that a client MAY choose to implement verification with current time in the case of BYO PKI and long-lived certificates, but this MUST be gated behind a policy and not the default behavior.