Thus required for self-signed keystone too.