HX509_QUERY_KU_KEYCERTSIGN
q->match |= HX509_QUERY_KU_KEYCERTSIGN;
if (q->match & HX509_QUERY_KU_KEYCERTSIGN)