Bug 945349 - CertVerifier should check early for bad usages. r=briansmith