Change the criticality of a number of X509 extentions, to match

the RFCs and real-world CAs/certs.

This improve compatability with older browsers/clients.