(input/optional)
           A list defining a validity period or NULL (implying "all time").
           This is the "when" portion of the request.

           If the list is of type CSSM_LIST_TYPE_SEXPR, then the validity
           interval is specified as a two-element list containing the
           values ((not-before <date1>)(not-after <date2 >)). Note that
           each element is a two-element sublist. The <date> is represented
           by an ASCII byte-string, in the format (for example)
           "1998-11-24_15:06:16" and is assumed to be GMT. Open-ended time
           intervals are specified by omitting either of the interval ends.
           For example, ((not-before 1997-1-1_00:00:0)) specifies all dates
           and times beginning on January 1, 1997 going forward
           indefinitely.  For programming convenience, when testing for
           authorization at a single point in time, the date is represented
           by a one-element list containing (<date>).