Gets the other certificates of the signer's chain to embed in the signature, from the issuer of Certificate upward; empty to embed only Certificate.
IReadOnlyList<X509Certificate2> CertificateChain { get; }
ISO 32000-2 §12.8.3.3.1: the handler "should capture the chain of certificates ... before signing".