HX509_CMS_SIGNATURE_LEAF_ONLY
sigctx.leafonly = (flags & HX509_CMS_SIGNATURE_LEAF_ONLY) ? 1 : 0;
flags |= HX509_CMS_SIGNATURE_LEAF_ONLY;