The validity period for TRCs cannot be set to an rfc3339 date, only an
offset from the current system time, which if set to 3650d rather than
36500d will still give us quite a long time before it becomes invalid,
which is acceptable for the time being.
This makes timestamps and cert expiry less of a spurious issue in VM
Tests, and in CI/Hydra, by hardcoding large values, and allowing certs
to begin at 0 seconds from UNIX epoch time
