better error message for 'verify entire trust chain'