old expired CA overlapping a new CA using template connections and groundhog

(using templates avoids bug #1006 where the CA doesn't switch with
<peer>id=%fromcert)

East has one template connection with <peer>id=%fromcert and
groundhog=yes:

  - new-ca is valid (for 12 months starting 2 months ago, it is used
    to sign new-west

  - old-ca that expires in a month, it uses that to sign old-west that
    is still valid

West similarly has two connections:

  - new-west: tries to prove its identity using new-west certificate
   (i.e., to the connection new-ca)

  - old-west: tries to prove its identity using old-west certificate
    (i.e., to the connection old-ca)

    EAST rejects this since the CA has expired

    since groundhog=yes is set, EAST retries authentication using the
    time that old-ca expired; this works
