More work for CRL checking.  This appears to work, at least
for an empty CRL.