der: more error handling
move x509/parse to der/reader