Should we reject any certs that have both `sub` and `principal`?