Removed disallowed certificate processing
The disallowed CTL (disallowedcertstl.cab) uses MD5 and SHA-384 subject identifiers, not SHA-1 thumbprints. Because the Windows Disallowed registry store is keyed by SHA-1 thumbprint, and Microsoft does not publish the raw certificate DER bytes needed to derive them, there is no reliable way to populate the Disallowed store from the CTL. Additionally, the disallowed list contains intermediate and end-entity certificates rather than root CAs, so they would not appear in the trusted root store regardless. Disallowed certificate processing has been removed until a correct implementation is possible.
Added --debug flag
Prints low-level DER parsing diagnostics during CTL processing. Implies --verbose.
--verbose and --debug now appear in --help output