pub fn pem_to_ders(pem: &str) -> Result<Vec<Vec<u8>>, String>
Split PEM into certificate DER blobs (CERTIFICATE blocks only).