Rework patch to honor first the CA compromised status and then check for the serial's existence.