restrict to verified certificates