Checking that a certificate has been signed with its signing key is only
half useful. Check with the CA certificate instead.