The things we need in crl/checker really only need x509.Certificate. This allows us to remove a dependency on pkcs11key from the crl checker, and transitively on CGO. I've confirmed that `CGO_ENABLED=0 go build ./crl/checker` succeeds on this branch, while it fails on main.  | 
			||
|---|---|---|
| .. | ||
| checker.go | ||
| checker_test.go | ||