xku_reject
if (xku_reject(x, XKU_SSL_CLIENT))
if (xku_reject(x, XKU_SSL_SERVER | XKU_SGC))
if (xku_reject(x, XKU_SMIME))