Stop using the Common Name of the x509 certificates in favor of SAN

[jeremycline]

Currently both implementations of the x509 crypto use the common name field to get the publisher's name. We should use the SAN field.

When moving, we need to make sure we check all the SAN values (as there can be many) when doing authorization. Patrick suggested that for compatibility, we might add the Common Name to the list of SANs for checking purposes though and issue a warning if the CN was not in any SAN values.