Double-check: prevent unexpired certs in inactive landmarks

[bwesterb]

The most recent max_landmarks landmarks are said to be active. Landmarks MUST be allocated such that, at any given time, only active landmarks contain unexpired certificates.

We should not issue a new landmark, if that means we deactivate a landmark that still contains an unexpried certificate. Do we check for this?