constraints: Don't reject certificates with invalid certificate policies