cert_has_option
cert_has_option(id->key->cert->critical, "verify-required"))
cert_has_option(id->key->cert->extensions, "no-touch-required"))