Fix validation of own certificate stacks

... and parse them as topmost-first.