> The check for trailing data ensures that the user gets an error
> message if she tries to load a PEM string with multiple certs. She
> might expect that add_ca_cert(pem) loads all PEM certs from the
> string while in fact PEM_read_bio_X509() only loads the first cert.

I don't think it is useful. Just make the behaviour well-documented.
(there is no security risk in loading too few CA certs)