OSSL_CMP_get1_rootCaKeyUpdate
if (!OSSL_CMP_get1_rootCaKeyUpdate(ctx, oldwithold, &newwithnew,
int OSSL_CMP_get1_rootCaKeyUpdate(OSSL_CMP_CTX *ctx,