Use email.utils.parsedate_to_datetime to parse RFC (2)822 dates
After c3a572d, checking the key cert via OpenSSL failed with a mismatch
between aware and naive datetime objects. This happened because strptime
creates a naive datetime object even when "%Z" is in the format string.
Instead, use the RFC 2822 date parser in email.utils, as this is the
output format of OpenSSL, which produces an aware datetime object.