The critical-extension scenarios need the old private keys