put an upper bound on certificate
rewrite extension parsing to not call error, but throwError in the ParseASN1 monad.