Rework the whole trust handling by acquiring the trust status from actual assumptions related to the amount of ownertrust signatures and revocations.
Currently only newly added certificates will be checked against the expectations as existing keys are not all fully compatible with those assumptions. New certificates are determined by using $CI_MERGE_REQUEST_DIFF_BASE_SHA as the base,