Transitioning calyx CA

For the new calyx float deployment, there will be a new CA that clients will need to accept. In the same way that we transitioned riseup to the new CA, we need to transition the Calyx provider. That means shipping this new CA, along with the old one, in the next release so clients can update to it.

This is the new calyx_ca.crt - I'm happy to verify this over a secure channel.