has_usable_cert
if ((pkey == NULL && !has_usable_cert(s, lu, -1))
if (!has_usable_cert(s, lu, sig_idx))
&& has_usable_cert(s, lu, lu->sig_idx))