style; and also check CA's validity for _now_