Add iotregistry support

[ashdwilson]

If an identity is issued by an IoT Registry, the Registry will be live-checked for revocation every time authentication is performed (revocation status not cached with cert hashes)

Also add a CLI option to require IoT Registry representation for all identities.