fixed #64 - no dsig KU check, ignore CA certs when computing the default
KU.