HX509_QUERY_OPTION_KU_KEYCERTSIGN
hx509_query_match_option(q, HX509_QUERY_OPTION_KU_KEYCERTSIGN);
case HX509_QUERY_OPTION_KU_KEYCERTSIGN: