X509: validateSignature() now defaults to not doing self-signed