allow intermediate and CA certificates without key usage extensions (pragmatic choice)