X509: check if a cert has been signed properly by a given CA cert