1. test delegated role that is served from repo as expired: client should not accept the delegated role version and download_target() should fail 2. test a delegated role that was already stored as trusted role earlier, but is now expired: download_target() should fail