Diff returns the sets of serials that were added and removed between two CRLs.

Validate runs the given CRL through our set of lints, ensures its signature validates (if supplied with a non-nil issuer), and checks that the CRL is less than ageLimit old.