security: In Certificate.decode, the extensionChildren are at index 3, not 4.