Handle missing responder_url in a better way

[danielgordon-switch-ev]

Currently, if the responder_url cannot be obtained from a certificate, we just put "https://www.example.com".

This is probably not reasonable since it just pushes the error elsewhere.

Handle this case in a better way, if possible -- it may be that we can also fall back here on the CSMS retrieving the root certificate, or trying a URL of another certificate in the chain (are these sometimes left out inadvertently in practice?)