issuerRootsByDocType

Each document type's own IACAs, as PEM certificates: a document of a type named here must chain to them, not to issuerRoots, so an issuer trusted for one document type can't sign another. With it, issuerRoots may be empty, and then only the types named here are accepted.