Update the Estonian workaround comments.

Target date for removal of the workaround is 6 months.

BUG=532048

Change-Id: I402f75e46736936725575559cd8eb194115ab0df
Reviewed-on: https://boringssl-review.googlesource.com/5910
Reviewed-by: Adam Langley <agl@google.com>

crypto/bn/bn_asn1.c

@@ -63,8 +63,7 @@ int BN_cbs2unsigned_buggy(CBS *cbs, BIGNUM *ret) {
    * moduli. They last five years and are common enough that we need to work
    * around this bug. See https://crbug.com/532048.
    *
-   * TODO(davidben): Remove this code and callers in September 2019 when all the
-   * bad certificates have expired. */
+   * TODO(davidben): Remove this code and callers in March 2016. */
   return BN_bin2bn(CBS_data(&child), CBS_len(&child), ret) != NULL;
 }
 

crypto/evp/p_rsa_asn1.c

@@ -96,7 +96,7 @@ static int rsa_pub_decode(EVP_PKEY *pkey, X509_PUBKEY *pubkey) {
    * use negative moduli. They last five years and are common enough that we
    * need to work around this bug. See https://crbug.com/532048.
    *
-   * TODO(davidben): Switch this to the strict version in September 2019 or when
+   * TODO(davidben): Switch this to the strict version in March 2016 or when
    * Chromium can force client certificates down a different codepath, whichever
    * comes first. */
   CBS cbs;

crypto/rsa/rsa_asn1.c

@@ -120,8 +120,7 @@ RSA *RSA_parse_public_key_buggy(CBS *cbs) {
    * use negative moduli. They last five years and are common enough that we
    * need to work around this bug. See https://crbug.com/532048.
    *
-   * TODO(davidben): Remove this code and callers in September 2019 when all the
-   * bad certificates have expired. */
+   * TODO(davidben): Remove this code and callers in March 2016. */
   return parse_public_key(cbs, 1 /* buggy */);
 }