remote: use the library's certificate validity if no callback is set

We should not return 0, as in this case that means we let it through,
return an appropriate error instead.