cert_matches_key
if (!cert_matches_key(ret, pkey))
int cert_matches_key(const X509 *cert, const EVP_PKEY *pkey);
self_sign = cert_matches_key(cert, pkey);
if (cert_matches_key(x, key)) {
if (!cert_matches_key(new_x509, issuer_key))
if (privkey != NULL && !cert_matches_key(x, privkey))