Only check the first certificate when verifying public keys by default