Rename `KeyVerifier` to `CertificateMatcher` and refactor some of the internals. This commit also adds test helper classes to help simplify some of the tests. See gh-38173