openssl: Don't check signature if issuer doesn't match always