axe bad logic copied from Cert::ExtensionStructure()