I really do not understand why each method now takes the whole ``certificate`` record. I'd expect that only the ``validate_signature`` would receive this record, whereas all the other functions should work on the ``Asn_grammars.certificate``. IMHO this code is much harder to read due to the record-matching and ``.asn`` projections, and I'd prefer to retain the old code.