SSL_SECOP_EE_KEY
{ "Certificate chain EE key", SSL_SECOP_EE_KEY },
#define SSL_SECOP_PEER_EE_KEY (SSL_SECOP_EE_KEY | SSL_SECOP_PEER)
if (!ssl_security_cert_key(s, ctx, x, SSL_SECOP_EE_KEY | vfy))