Are you certain `name` is always guaranteed to be the CN from the certificate itself?  Could it be `node_name_value`, or `node_name_fact`, which are both client side configuration settings with values that are not digitally signed.