Invert the CA signature checks.

Previously, we were checking whether the CA certificate was signed with
the client certificate; this won’t work.