More explicit behavior on missing trust certificates in chain