first extensions are verified for CA certs:
 basicconstraint MUST be true
 keyUsage MUST contain keyCertSign

also, style