Investigate TLS 1.3 changes for issued certificates

[iadgovuser59]

To support TLS 1.3 for ACA-issued certificates (LDevID and AK), the following would need to be considered:

• Signature schemes. TLS 1.3 supports ECDSA, RSA-PSS, and EdDSA for end-entity certificates according to RFC 8446. Currently, RSA PKCS#1 v1.5 (via SHA256WithRSA) is being used when signing issued certificates, which is deprecated for CertificateVerify use in 1.3.
• Key usage. The key usage may need to be digitalSignature only for TLS 1.3, vs. current use of digitalSignature and keyEncipherment, per the specification "TPM 2.0 Keys for Device Identity and Attestation".
• Other. The rest of the CA chain should also be considered; that is, it should also use one of the above compatible signature schemes for TLS 1.3.