Add algorithm checking to distinguish between signature constraints and key constraints (bad signature algorithms should be skipped for trust anchors, but key constraints should not be)