Consider adding `TrustAnchor` distrust after date field

[cpu]

See rustls/webpki#259 for more context. This would be a breaking change, and so should wait until there's a sufficient number of other breaking changes to justify the ecosystem cost.