CA certificates are looked up using the subjectPublicKeyInfo keyid