WIP: certificate verification with service_identity