diff --git a/build.zig b/build.zig
index d1225f9..c7ef9e5 100644
--- a/build.zig
+++ b/build.zig
@@ -68,4 +68,16 @@ pub fn build(b: *std.Build) !void {
         const test_step = b.step("test", "Run tests");
         test_step.dependOn(&run_test.step);
     }
+    const trust_probe = b.addExecutable(.{
+        .name = "trust-probe",
+        .root_module = b.createModule(.{
+            .root_source_file = b.path("examples/trust_probe.zig"),
+            .target = target,
+            .optimize = optimize,
+            .link_libc = true,
+            .imports = &.{.{ .name = "websocket", .module = websocket_module }},
+        }),
+    });
+    const run_trust_probe = b.addRunArtifact(trust_probe);
+    b.step("trust-probe", "Reject incident TLS hosts and accept a valid control").dependOn(&run_trust_probe.step);
 }
diff --git a/build.zig.zon b/build.zig.zon
index cb07ff7..3a0d86a 100644
--- a/build.zig.zon
+++ b/build.zig.zon
@@ -1,6 +1,6 @@
 .{
     .name = .websocket,
-    .version = "0.2.0-alpha.3",
+    .version = "0.2.0-alpha.4",
     .minimum_zig_version = "0.17.0",
     .dependencies = .{
         .zlib = .{
@@ -14,5 +14,6 @@
         "build.zig",
         "build.zig.zon",
         "src",
+        "examples",
     },
 }
diff --git a/examples/trust_probe.zig b/examples/trust_probe.zig
new file mode 100644
index 0000000..08f3fe7
--- /dev/null
+++ b/examples/trust_probe.zig
@@ -0,0 +1,26 @@
+const std = @import("std");
+const Client = @import("websocket").Client;
+
+pub fn main(init: std.process.Init) !void {
+    var bundle: std.crypto.Certificate.Bundle = .empty;
+    defer bundle.deinit(init.gpa);
+    try bundle.rescan(init.gpa, init.io, .now(init.io, .real));
+    const original_count = bundle.map.count();
+    for ([_]?std.crypto.Certificate.Bundle{ null, bundle }) |supplied| {
+        for (hosts) |host| {
+            if (Client.init(init.io, init.gpa, .{ .host = host, .port = 443, .tls = true, .ca_bundle = supplied })) |result| {
+                var unexpected = result;
+                unexpected.deinit();
+                return error.CompromisedChainAccepted;
+            } else |err| {
+                if (err != error.TlsCertificateNotVerified) return err;
+                std.debug.print("rejected {s} (shared={}): {s}\n", .{ host, supplied != null, @errorName(err) });
+            }
+            if (bundle.map.count() != original_count) return error.SharedBundleMutated;
+        }
+        var control = try Client.init(init.io, init.gpa, .{ .host = "atproto.com", .port = 443, .tls = true, .ca_bundle = supplied });
+        control.deinit();
+        std.debug.print("control atproto.com (shared={}): TLS succeeded\n", .{supplied != null});
+    }
+}
+const hosts = [_][]const u8{ "dv-g3b-emudhra.we-have-a-problem.com", "dv-g3b-aaa-emudhra.we-have-a-problem.com", "emudhra.divy.zone" };
diff --git a/readme.md b/readme.md
index 63d6030..9c088c6 100644
--- a/readme.md
+++ b/readme.md
@@ -737,3 +737,16 @@ var client = try websocket.connect(allocator, "localhost", 9001, .{
 This allows each client to have a reasonable `buffer_size` that can accomodate most messages, while having an efficient fallback for the occasional large message. When `max_size` is greater than the large buffer pool size (32K in the above example) or when all pooled buffers are used, a dynamic buffer is created.
 
 </details>
+
+## TLS trust
+
+Version 0.2.0-alpha.4 removes the four roots and eight compromised intermediate
+public keys from the [October 2026 eMudhra incident](https://emudhra.we-have-a-problem.com/)
+from loaded CA bundles. This includes caller-supplied bundles. Chains anchored
+only at those roots fail, including otherwise valid certificates. Keep the OS
+trust store updated as well; Zig's macOS keychain loader does not apply native
+revocation policy.
+
+`zig build test` verifies the original certificate fixtures offline.
+`zig build trust-probe` checks both public bad-chain hosts, the AT Protocol
+identity host, and an ordinary HTTPS control through the actual client.
diff --git a/src/client/client.zig b/src/client/client.zig
index 307b168..6ab7b7c 100644
--- a/src/client/client.zig
+++ b/src/client/client.zig
@@ -118,6 +118,7 @@ pub const Client = struct {
         const host_name = try net.HostName.init(config.host);
         // 0.16: connect requires mode option (stream vs datagram)
         const net_stream = try host_name.connect(io, config.port, .{ .mode = .stream });
+        errdefer net_stream.close(io);
 
         var tls_client: ?*TLSClient = null;
         if (config.tls) {
@@ -696,11 +697,18 @@ const TLSClient = struct {
         const bundle_ptr = try aa.create(Bundle);
         if (config.ca_bundle) |ca| {
             bundle_ptr.* = ca;
+            bundle_ptr.map = .empty;
+            var entries = ca.map.iterator();
+            while (entries.next()) |entry| {
+                try bundle_ptr.map.putContext(aa, entry.key_ptr.*, entry.value_ptr.*, .{ .cb = bundle_ptr });
+            }
         } else {
             bundle_ptr.* = .{ .map = .empty, .bytes = .empty };
             try bundle_ptr.rescan(aa, io, Io.Timestamp.zero);
         }
 
+        @import("../trust.zig").distrust(bundle_ptr);
+
         const rwlock = try aa.create(std.Io.RwLock);
         rwlock.* = std.Io.RwLock.init;
 
diff --git a/src/trust-fixtures/README.md b/src/trust-fixtures/README.md
new file mode 100644
index 0000000..441b0bd
--- /dev/null
+++ b/src/trust-fixtures/README.md
@@ -0,0 +1 @@
+Public certificate fixtures from https://emudhra.we-have-a-problem.com/roots.json, impacted-intermediates.json and chains.zip, retrieved 2026-10-21. DER preserves the original signed certificate bytes. control.der is an unrelated self-signed RSA certificate; its private key is not retained. trust.zig blocks SHA-256 SubjectPublicKeyInfo digests so cross-signing cannot restore a blocked key. This intentionally distrusts all chains anchored solely at the four affected roots, including otherwise valid certificates. Zig does not consult native macOS revocation policy when loading keychain roots.
diff --git a/src/trust-fixtures/control.der b/src/trust-fixtures/control.der
new file mode 100644
index 0000000000000000000000000000000000000000..69e7d0ed09973fcd914d917df4321f6f86eb97dc
GIT binary patch
literal 811
zcmXnKVpcb3V&Y%G%*4pVBqC$1<PbKIv0UKuatRUEq>L5LY10jO**LY@JlekVGBR?r
zG8iZuDjLYMF^94+^GK8wl@^yM6s4vYr4|=w=I1FS=jW9a<>wg4iSrtn85$TF8k!jy
zn^;7N^BS8O8W>tYxx^XL#HfU9IU_3ra}y&!gFzD`7gG}>Bg4tr5z2E~j_LAxM}GV;
z>6%}+u=vK57os=UncOo`I?2BFuS4sZ%^%M1$~^Mqyhq&s#j8){Ex(^6a_U*_!W+$#
zMgG+GoSbF8SopZ^DUZc>*>)_{nH_j6NHb%``U#Djl9$B4JQ9?7ij}J-@8u6QoxdfI
zyFSIo9<VxA_*eDqwJVkTdZ&F_r?T``N@Mg_D}CE@uYY%}$S_|lR;b*+vc>K1@fXam
zvPHZSUTQ~db1S=Q`^VvlKxF=(%-7!2ofj;4(>L!#@bs=vj5R$I>zR}tl(zOfu8)22
zYu)OZYS)}ap8u8LKg{t-KdHLgu>Nqdh3aDOAM?!r&l3K9j#D8+u|_s@cB+8sUnXWo
z2FAs~27v~$Y|Npud@N!tB43ZNe_T)$X4$by+)$3mYf-VZx+*xjWR+PY48$6+E8qv|
z7iMJq&%$cJ%*gm3IoP?u!44QBL%*3rOB3T$$qCCP17kvZB+mM4RsZ0fVyJ50=qB36
zVgCHD<Gp~|_%0^#?|~hDAMH8s?ialL(D%;+VZU{Ui*&Dljqq9!_T24b%KzIJ=e9*W
z*vefIt}};m`QM<x6vr<~KRbWbu}`%+@nohJf6AP%``uUdm@Zd7w0Oed?7yv*+3^Zx
z*35e@?Pk_CsFctUbbLN_x1fDuv+k>~ud#C{_WfNc?xynj^I3y4j{0?4|F<14i{<wI
z^_GE+^W-_ZZ3-UEqK)C&U-wN={P(-*mYUA`@QYUj^0<|)_SfBDX!Lx${N#(7$vZ^~
i-WW~zA90=`I>K(-{X5ssd(CTAES_q#dyePLuA2a)FHC^|

literal 0
HcmV?d00001

diff --git a/src/trust-fixtures/dv-g3b-aaa-emudhra.we-have-a-problem.com-0.der b/src/trust-fixtures/dv-g3b-aaa-emudhra.we-have-a-problem.com-0.der
new file mode 100644
index 0000000000000000000000000000000000000000..b82c1e482a9dbe0683a2741b0f3270e7b16dc587
GIT binary patch
literal 580
zcmXnKVsbEOVm!8hnTe5!NhG*(L0`1}$4NE2X0DrfGsscaL;R}&7aNCGo5wj@7G@>`
zdqZvmPB!LH7B*ofKOaM313?gni-#-Kw=^ZAC{e*F%uw1u5+umXBjoC<;1Z?~;uEak
z?5Lot;BM?>AScdiWM*h!WME)qWMpC(CC+PPZeVI)Y+z($Zekc^U~Fh;pbycmky56c
zZk(i>n3$-WnhQ2wuRK*ZBe5)1H&M5sC_gDDHCHb=Ki44AK$wjk>_#R=sAHKK*_oXf
zSWewLe#crS*EltH^%d#EA19g}e5!i#mBK}ixy9S-To)ex7~y|baniyimrQ#9I4#OA
zlT<tPQ(FB=;whI7-qi<As4Z?>ZP2*FfQOAaR92Xg@jnZb0fPY_h{q4&0mj12#NJ>a
z4C1S@@PI-}n~jl`m7ST<z!)Sb$f9GQ)kM5UWI>wvSj1RFEEH-c7GHfndBMufA|f*;
z99X}Edy9cQNLrai!a%G+<dK~Ia~VlXzEJO^g9<9)rYc>kA|MBVgMo#ai8+J8AeG6$
zs+s3?wRUZ}L*tiqlK)dyeinOg_y6i1tB`kM7w(6sT;%<dw(`#W4eF;icv>G@_-ZGU
zA;YXqIxY@uskR^etSq!AKiyT??z48MB8SAe7i+D&iu8i6y><M<yzJ25s+)cneUJLf
F0078px;g*=

literal 0
HcmV?d00001

diff --git a/src/trust-fixtures/dv-g3b-aaa-emudhra.we-have-a-problem.com-1.der b/src/trust-fixtures/dv-g3b-aaa-emudhra.we-have-a-problem.com-1.der
new file mode 100644
index 0000000000000000000000000000000000000000..48a42fa4dfab49e69e45fc7ad33ac8cc3ae2f897
GIT binary patch
literal 978
zcmXnKVm@ck#I$VzGZP~dlOV$amA_whrNvalJXxUNVG*(2fR~L^tIebBJ1-+6H!Fid
zwIR0wCmVAp3!5;LyOW``fh35-!6W2el$uzQTBP8cn3tT9T3nJ^WGG<32a;sxVGmBs
zNy{%vF_bcp0Euw%2s-EI=BMN<I6Er%Waeg;q^1}u8pwm>n0X`|9UT>%Q;SM6(=wA2
zOHvhrQ;W(nlT(Wg<ivT6Obtv8O$@*wN}Sio!qCXr(8$=-($q4_z#hqQem;i627(|H
zxp=rzeM?g^iV_u^!eB0D<`HuBRd5MY2=NI9xk6XL-Pp;X%s_yRU8~LGoGlY08>@CB
z3xg7K5(CTgc{dMuO)oxD92Y1kyCUk)-nf+2=H3ktb@nJ&ypi+gvu@Ns**Z@yef<VM
z{qB?XC9S(sS51_AvE)f~($zD}SF@j0Y(Ctx<<8`qMQ(h`Ex{)yO^(&P;y>|W7~3|R
zbGNo+EN)^nHE3cq1c!jEGK++PScAv{K`v#xX&>3&JX){$zG-Rw1%oA93}o4uLuL6`
z#8^Zg$>~3rk+kFs^-emdpb~DX(xoZ_4sTh0M#ldvEX+)dYz9Ig<-#C7hXETS<9{Yb
z28a==EMf*CY#iEbjI6Be%#3grlYt>fivo+5frbGG8(VrK4<i$!0WTZ3HX9=gV{@M(
zBLgazDaF7Uq(z>^#=y$JVu9HLlQyG_l9B=|ef{L39KGaxP(&vuf*AUaj*dtX3yW91
z<f0q{6POzq8Cf(8)C^Q$d;`Wd38;Db$;AaAbMjO2AqJwQPQaL(7#SIgor5%1P0!eJ
zZh_dA3g<FyE%kG{&lW!|eK#*WGsORWTJ7W`x|=SY*GN*j_@trb(9&=Zxw9{XO^xRF
zcK$n=C-zP03`4C-g_5St4_PI*jNMbac&Do~HB>y?WV|eOjgOP_v)%&EoV@slai&(M
zPo|~pp3?jJLic(B)9^b9lGm%$Uo@$CoiEC{<?g)MX_d3Ud&VC-n75YQay@y1)AQmj
zju-BIy9{rL+>qFw8MMtHxsZ>^GV-J2g3Z#_Gx9gCdaRmr*IU%3psrHX;P2%>1|I2u
z*4%#SE3V^pC(>cv){6hWCOa*!vPb%TYV31u4_{~(D(N$k!-=^iE|}H3OT5v1;@?C7
DSIjim

literal 0
HcmV?d00001

diff --git a/src/trust-fixtures/dv-g3b-emudhra.we-have-a-problem.com-0.der b/src/trust-fixtures/dv-g3b-emudhra.we-have-a-problem.com-0.der
new file mode 100644
index 0000000000000000000000000000000000000000..4f77f798dc0f64a30c28ecf9021ad2075504035f
GIT binary patch
literal 573
zcmXnKVzM-7V%)cYnTe5!NhCR>-lpnptVZai7vAa<jrtD0H_|oWV&l+i^EhYA!pvk~
zZ^&)H$;KSY!Y0h*=VK^rAPC}c@o=U3mZoGBB`P?D8A=;Sf&`g)gj{_UT*4GWe1a96
z9TjvH+>M<K<ivT6%nS{T3=9lREsf2h#CeU(4NMJ;4GaxTjLo79^bK_lv?1D6Qp$AG
zjgxd!bHPUIm8a@vB$lP>Ch8Ux<tOE&=ISNq=Nd#B2(z(+-N(cTbtp3<JF^o5OO(s)
z1}2uk3;I?Gzc>7Ty*p98eu7CCr`ih<L;G`e7mZ)!t>e9u>is^nwv3UF)4gZL>K^B#
zW}JQ!vjj}J7oFd@xN*5b;}QcNHs(-SVMfOPEKCLr27DkMKZpky3o{dYgMl!Jugby$
z3MFkeMpjmKW<~>jkf0!ohJjiWah{L`Y2afKV-fkWe)f;5YrH#hx3VqB+MM^@%ALK#
zKprHm%pzeR)*$joPXD=#q$OXdchW%xm2gv)E>#hb<=`M-VP;~^WH3l$GGv%8?E3q^
zD#NdY&TShQbhbX%{F!_D@}x80(s>2H+ouPtkGpeZ(&QK6Ssd27VZXzhbD0bo9<7-;
zb)o;nRVwRB9<St>xB9>WUcR-;wnuxUAK$TiKS^l1?8>FD4ZfYVOKMNEn_{~V0M8z<
A=Kufz

literal 0
HcmV?d00001

diff --git a/src/trust-fixtures/dv-g3b-emudhra.we-have-a-problem.com-1.der b/src/trust-fixtures/dv-g3b-emudhra.we-have-a-problem.com-1.der
new file mode 100644
index 0000000000000000000000000000000000000000..d200e0d704ca125e70f5b658898cdef407c93b6d
GIT binary patch
literal 876
zcmXnKV$LvVVtTiLnTe5!Nq}L=x@Q%ijFYw;c#^Qa=#z*67aNCGo5wj@7G`FHFhgzw
zPB!LH7B*ofPd`Id17#40i$^Baw=^ZAC{ZCKH8~?MKPNvuGqqU3Co?y*BsIlQ!9WhA
zjG0F~H8(gjJx?JhKfgpF#3xw6*-=4P!QI$EPMp`s)WF2pz|hpx#K0m-oY%y_z{JSH
z(8Acjz#z)N9?4!mA46dSL6Cu5JX|n)ox%*I4J1K=%sfJ_z6vg3$mTm4lo<%Hv4g$A
z#K^{~-N?eA#GJ&y@_gRS176dMj}*rR3d*jCI<z+~Wwp6?!$X}t3KnnV{Q0aK^-s3W
zlS^N}!B4;YWPM5NuGCc%<z6g#5}kDQ4D;3OXBC?d_iVW{xn_|YpK?p^iAj@VHLv(j
zd>F>I&F0*#Eg6fO7^fLDF-|g&XJZbPRc4Ve5Ni;5Xti3g=Hp}Ekabszw*T#pbW)fQ
zVjv4rz{euSBJxO1|GA8$C10p_(m@54a8s2oRS}4^DvOwb2pfks8zU<#J2NAk#bgi*
z(yhP}W)Nav$;PeC#>m3h+^5LMz-XXlpaE0I#3&|{QBqQ1rLSL<T999yS(0B=sh65t
zoSB}dmz<w#z>B1nDaC+;jV-;AhmncVpcG~VBO^<uLArqojBmi$CIK}vKe@O-HwoD|
zd$=m5He;wNz_41ZpPX7$QmpUl>k<~?6YT8hZtSF2V4iGX4)T>ei-CcjfzAT01sZK?
zP*akNa*!<2w=c@iFDc0>PEJfW)=MtRG2jDf<Y#33&%(mY#K>kK1mX*W_#6gojEw)8
z7#Wb0HFE}oK`N7hUN&2t-U^XJWs@Rh1dg8B#kXL;h*)Z-+#!W);U-4YlYX6F@Xqn`
zImI2NO}p;~Y&gVZ$Z&M_>FJ_Ud-C?GuTl3h*b^i6%A`d{eL>4jc3;c)7It@{Uk2`J
Rx;uI5r)W8ieHyn<0RZkv06zc#

literal 0
HcmV?d00001

diff --git a/src/trust-fixtures/dv-g3b-emudhra.we-have-a-problem.com-2.der b/src/trust-fixtures/dv-g3b-emudhra.we-have-a-problem.com-2.der
new file mode 100644
index 0000000000000000000000000000000000000000..76baf7160f57e167399b56a31de806559275cf44
GIT binary patch
literal 888
zcmXnKVlFXgV*0s&nTe5!Nq}LRl-+OP$nd-i4y;=;yrK=b*f_M>JkHs&Ff$uu8*&?P
zvN4CUun9AH`WXrv2!c4=!d$7j!I|lK3IX1phN=e2AVDr+nN;7>l#HT8g^<+bjJ*7u
z{PfJ!Vg;Yf+{}{H6hj3AIgm1DVR5KlS7&F1p#1z21!qSET?Kbz137VCBNGF2LqkJT
z6JukuC~;n6O9OKQOG67|0|SF7gD_Ob!0hEA&R!mvy<j^-e1hTjmKg}Jv4g$L#K^{~
z-N?eA#GJ&y63>6fes#Fmk$ufyH?zqvnDFTR0>-#D^V@dzEQVhsD_ZoobovWe`Kv{|
zzj(03=(@upZ;?NHl{mQqPc46-@o14(Y5UZRI+AZT3!KyGt``!q>}y+RwtpjIfzC4d
z5AMz}Jd2wcOAVSB3k~Gim_uciStJa^8boShnOcOeoavg~curhKPg8D=N3xTFEJy(#
zix`W@L#x$_H6I`QhOE0%wEb^)q?5vg5QwxYi<p538;3R<BP%OAGb5bEWMB)@t-xYt
zU}9jz#u6&4z+j+dpaE0B#3&|{QBqQ1rLSL<T999yS(0B=sh65toSB}dmz<w#PytiP
z$jFjokY%6*;~Oxxi9vPdCl?nW>v4grVQRC0ssRkE>H5j3MJ2`hkQCwS><o$<XGeEq
zz2u@217ncG<ymw<&Rw9kK&4FyYE*Jj4w7y5NSbmC_&}QY85#exurM<*vKa`0_`)DQ
zhXETS<9{YbM&uOEoXKF2#$?E_{X)l5!Ih7fusb$fVJkXy`1N~j|A*gxE}G(?;I~U;
z`nTosJ!NYPUv+3Z`iMW!FkirA$nY`C?aG#$B~08GLT0QMz31XK&sWD~;b)U;M(+0v
Z*K-!^{<76J;8WS+k}E%*ly5PM0s!Vt1#<uZ

literal 0
HcmV?d00001

diff --git a/src/trust-fixtures/dv-g3c-aaa-emudhra.we-have-a-problem.com-0.der b/src/trust-fixtures/dv-g3c-aaa-emudhra.we-have-a-problem.com-0.der
new file mode 100644
index 0000000000000000000000000000000000000000..7f067a29de2a9dbce32e06a491330503fe8fe1a2
GIT binary patch
literal 582
zcmXnKVsbKQVm!WpnTe5!NyMP`^Xs&#EJhI>v8=T}G7sOsxkSN$i;Y98&EuRc3p0~}
zgCVy8CmVAp3!5-gXt1G(fe?tp#lxNITbhzll&IjDmux6)APEv><`HuBRd5MY2=NJ4
zaCTJCRd6?UHjoqNH8L|aFfuSOGBPqTj1uQHGB+?aFg7qUGB+`dGB7qYG|-1=*GMVT
zO*c-~O-xMGP0a<HuUDR`n~_+Ss+*`=P?VpPlbWlSoS$nDX&}tT4t69HBh<CbjO@%#
z3@i+XU&<ZP5?Um;ZpZ(!SLX!oJ(%d~=^4Rcb8lbB+%*EJhfgg%U>^S5+;APE^8bg4
z+82cs+wR^;`aLCS?xdvl*M}E3t~O{~VZg)294af!$oQXy$$-It55(gK@mK(3W@2wJ
z5C-v8S$IG}rOn33%F52nXkZKy6lBpc&}t&yBeEb(d@N!tB7Zop7(aM)bxx1AW1FM+
z`+eU`4(&IP2T3clNEnDUh^(s<h_TU}c5sEeI&0*|2ewz9a(xCl02~Y~%uLLg3<haT
zh78Ngyh}giYaT0XlwJ8@Th!5<^RFIMpY=bIe!=1Kg*P|;IiBnkTzH4;*>Z#JP4yxB
z-!mC9%&W;R+Hn1?&I@(vg^Sl(NJvywD|oAHm^<^#zLopCnX7j$7XEK#V9dd1xIfb1
HrR5F)Z2P~^

literal 0
HcmV?d00001

diff --git a/src/trust-fixtures/dv-g3c-aaa-emudhra.we-have-a-problem.com-1.der b/src/trust-fixtures/dv-g3c-aaa-emudhra.we-have-a-problem.com-1.der
new file mode 100644
index 0000000000000000000000000000000000000000..a14835558fe1ad95291e69bd8454185e67e80f04
GIT binary patch
literal 979
zcmXnKVm@!s#I$_@GZP~dlOV&y&+Z?WZofP;X=fbYlSeZz8t}4lYPET^edlFl<Yr|s
zs5ay_;ACSCWnmL$a(6P6Hjo5yICzBIi&7IyQi~LP6Z4WYQj1Gciwp$}_&}2EJnX@V
zIcfPtDTY!85+D&S9zo~)-29Y$1!qSEpUm9MlGGGKMFV+|95auEqobpOb81mZW?E))
zVo9n(aB5LmW^!t=ft)z6k*R^Hp@{()M2YhnSr{4_8yXp#TAEr$88{$0E;QIs#6SpS
zA{P&Ls&8pZMp2@IXI?VQ$;>=LuD%K`VG1EW!60YoD!3av8<ZIcu(4~kd7QIlVq|00
zZe(FlVoqXUv8t*_I&s9;$oFn0vsHT2f%otJIfOpz60%=lF1>i~#3_M(4~v!<KThUn
z+AGmue)Flw{MqHVrz~o`KciazRY!Np-hchKd<15`%UL)z?VsI;r{6Zr3e7pwy_7Za
zzO<H$EaT!PMpJ_(MniBA$SSi)7>G59ED+>Uwwv~m{mrBGn(v#I)?YAKvc*7_jX6}7
zk420{WL=#=jE&~BgDc$CStCC_u)Xq>>oYjOW%(Hy|Ff_#GcmG(13*?7#OE+zV`Ti#
z#K-_KLX}0#K!lA$n~jl`m7SRp&SEk!1lgd#qGh0Az`@3r-pIqq#Av|F#;wi9$imp%
zr^v{F%4JG1a0Y3SXR$G`GO$=+w!oy#D5IpLz)D{~xhO|3IUf|$$%!C_zN4cfQq004
zRxi0I$G`;U21Z5}4Ffd;6&T-uu}uPMUVd_M0mz*ElzfPRXvq^W<|al)hV|Qi8OxUX
zG$n)^zJ1~Nb47AkmBy+Cr(S;WtDk(@uJ8BC<B?xJS4BQ8-W+V~e85%iVjk0jAhv+w
zfQJPiR=hDevCiz+%57yIx|&XE-1I&?)mAZcYOas^G(+ZjPv)OIr`A(DM<?a_&AZDw
zUKYQNFv~sI&yaEbQ|5z}c{g`T9$bFn>XJt$y-RmzE?%5mTiwqQyzJhV$Lc+ww*0%i
zsc(@{F8Aed36Yn<vzp&Oo?Gdj_1)v=DZU$v7swy}_rvg9$9vx84^HGq)z;fhUA)(H
zGtc>ME$-->$Lnhz>AzvQn6!&?d)W7^C(k|ItlPLlICQ$L%J@&+(-(DGl9~Ih=bMwN
Iu~~U303;+#MF0Q*

literal 0
HcmV?d00001

diff --git a/src/trust-fixtures/dv-g3c-emudhra.we-have-a-problem.com-0.der b/src/trust-fixtures/dv-g3c-emudhra.we-have-a-problem.com-0.der
new file mode 100644
index 0000000000000000000000000000000000000000..86e6a209a46890d6051180199fd982524e046e62
GIT binary patch
literal 572
zcmXnKVzMx3V%)!gnTe5!NhCM>?LlR)zg#bF=e}oJv-y7RzYqZfE;bIWHji_*EX+&>
z4u;$YoNUaYENsF|p}~eC20|bX7Y}!;Z)r+KQKEupUb3OIfh0(jnMcUgSHUGrA;c$G
z!P!wkSHa!b*+5R5*T~G!z{tSBz|_*%EJ~c$$lSoxz}Udhz{J=r%0S;x*FYPhT_vSV
zH{Cc{H#HY*wqALvZbo8Rs&1lgK~a8EPHL`Ra(=Esq=7ISJJ^9tj8K;{GqN)~F|f=j
z5z#bt?&CbR;ANwz=y6_G#khdZl3R*D?|rzxF!`jYuF2D!SK<ZzyeA$1`7E%{5EJi8
z__r^?wmn_B{#WRo*NYpM8#FF4;9+A9l@(@W{LjK<z+k`!;sM4F;;}F@u{Rh9gZQc}
zJfL9GW@BV!WoKqI&<6<$vS=8nH4*0tS&#-k7BLnPHrq`S?=PP*Zu$5Am*Z3Y!hEA^
z$_DZvX=N4(1F;5?b#($UHk#88u5edpjr{n)_R3SP&mhaeLBPVy#GKAxkiulZ%G~F)
zaBt!9V&i|;l|oN%>yEnmnn8Ebvj*q-boLb+g!Cu(MCFvTxK2`!3^K6p^JOx~*nCvZ
yoZ;Tp+FPxcwoUWNV)0@$y2`F{x5lr?YjftQYn;=U9D9~Li)#*xK!c*B4Icms39-Qd

literal 0
HcmV?d00001

diff --git a/src/trust-fixtures/dv-g3c-emudhra.we-have-a-problem.com-1.der b/src/trust-fixtures/dv-g3c-emudhra.we-have-a-problem.com-1.der
new file mode 100644
index 0000000000000000000000000000000000000000..8fe252037d13cf433becf937b74f68930dd6e273
GIT binary patch
literal 876
zcmXnKV$LvVVtTiLnTe5!i9e!S&qjO4*@bpeLY%73iUwS499nH2=WJP+nGM1WxeYkk
zm_u3Egqb}33{?%3K^!g~nN;7>l#HT8g^<+bjJ*7u{PfJ!Vg;Yf+{}{H6hj3AIgm1D
z9`V%N;LP+qg`oWW5`_?-U<GGK1ziPqV*@#HUL#Wj6JrBIQ)5#D%P4VP69WSiBMU<d
zV*>+&C<6y1dqaZ_MGS;M26FLm!|e6UOE#1?kOYY`^9Z^6D!7CpTi|R^W+1@E4)zBV
zBO9xBBMXBPa}ooKRaHgOi6g#7zIQX3t<swgynpx4A@o_7ko^L4>BV~|P6_mTShU3W
zaWX&CUWo?tn@>gN&n~|`Wl`h(8P)o)I=V~t{_DTxBQWz_&cdl_|Li_I{kCCNXwI4L
zrL2kfrL|mS85cJ(PBUm?oMa%+#vCfE%pzeR)*$lGYPDj`$H%@Q>#h`S|Jxnuq%a}G
zKo+Eck420{WL=#=jE&~BgDc$CStCC_u)Xq>>oY`Jl|{@zgpEU+jggg=otY8NVls#Y
z=~iF~GYB!TWaHLmV`O1$?o(uBU^LJ&(1599Vic3fC@Cqh($_CaEyyp<EXgmb)Jx4R
z&P>nKOU}<V;6>8Plw!ca#+Kg5!^p&FPzp1Gk&z|SAl*O(#y4PWlYknTpIls^n~ZFn
zJzN!2n=w=sU|22IPfjf=Db{!ObqNdc33hgLH+I%5Fi$ox2l+~##lS$%Kxcv00*y8`
zs42-sIY<`i+ZW~Mmz3lbCnu&G>m?WE81R8K@-s62XJKJxVq^m+7g=EtpTmHSk?}th
zBLi}}X3k(RNM$l)ILLdWv}fV5cae9tme;<NUzBO|`G5F_6W){Grtbdgyyd#!p6p_s
zgj3IBEoRFk7<o=%GGOm!zakawdEoQJ3qQ6@2s*TJ|CKW}x4!*JTr;UkIB$3S)`i8f
R3{D#|=BkC8%sHLE3jpY*2ABW<

literal 0
HcmV?d00001

diff --git a/src/trust-fixtures/dv-g3c-emudhra.we-have-a-problem.com-2.der b/src/trust-fixtures/dv-g3c-emudhra.we-have-a-problem.com-2.der
new file mode 100644
index 0000000000000000000000000000000000000000..76baf7160f57e167399b56a31de806559275cf44
GIT binary patch
literal 888
zcmXnKVlFXgV*0s&nTe5!Nq}LRl-+OP$nd-i4y;=;yrK=b*f_M>JkHs&Ff$uu8*&?P
zvN4CUun9AH`WXrv2!c4=!d$7j!I|lK3IX1phN=e2AVDr+nN;7>l#HT8g^<+bjJ*7u
z{PfJ!Vg;Yf+{}{H6hj3AIgm1DVR5KlS7&F1p#1z21!qSET?Kbz137VCBNGF2LqkJT
z6JukuC~;n6O9OKQOG67|0|SF7gD_Ob!0hEA&R!mvy<j^-e1hTjmKg}Jv4g$L#K^{~
z-N?eA#GJ&y63>6fes#Fmk$ufyH?zqvnDFTR0>-#D^V@dzEQVhsD_ZoobovWe`Kv{|
zzj(03=(@upZ;?NHl{mQqPc46-@o14(Y5UZRI+AZT3!KyGt``!q>}y+RwtpjIfzC4d
z5AMz}Jd2wcOAVSB3k~Gim_uciStJa^8boShnOcOeoavg~curhKPg8D=N3xTFEJy(#
zix`W@L#x$_H6I`QhOE0%wEb^)q?5vg5QwxYi<p538;3R<BP%OAGb5bEWMB)@t-xYt
zU}9jz#u6&4z+j+dpaE0B#3&|{QBqQ1rLSL<T999yS(0B=sh65toSB}dmz<w#PytiP
z$jFjokY%6*;~Oxxi9vPdCl?nW>v4grVQRC0ssRkE>H5j3MJ2`hkQCwS><o$<XGeEq
zz2u@217ncG<ymw<&Rw9kK&4FyYE*Jj4w7y5NSbmC_&}QY85#exurM<*vKa`0_`)DQ
zhXETS<9{YbM&uOEoXKF2#$?E_{X)l5!Ih7fusb$fVJkXy`1N~j|A*gxE}G(?;I~U;
z`nTosJ!NYPUv+3Z`iMW!FkirA$nY`C?aG#$B~08GLT0QMz31XK&sWD~;b)U;M(+0v
Z*K-!^{<76J;8WS+k}E%*ly5PM0s!Vt1#<uZ

literal 0
HcmV?d00001

diff --git a/src/trust-fixtures/ev-g3b-aaa-emudhra.we-have-a-problem.com-0.der b/src/trust-fixtures/ev-g3b-aaa-emudhra.we-have-a-problem.com-0.der
new file mode 100644
index 0000000000000000000000000000000000000000..f32a8762f1ee65914b8f34c29d36b6e23558c129
GIT binary patch
literal 580
zcmXnKVsbEOVm!8hnTe5!NhGj)yY;b`=7Iftl-O5h1^)>XF|jh>V&l+i^EhYA!pvk~
zZ^&)H$;KSY!Y0h*=VK^rAPC}c@o=U3mZoGBB`P?D8A=;Sf&`g)gj{_UT*DMXe1a96
z9TjvH+>M<K<ivT6%nS{T3=E8nj7$up#CeU(4NMJ;4UCM;O$?(9j13J9^dZ_cQp<GH
zjgxc}6BBh)bHT>zm8a@vB$lP>Ch8Ux<tOE&=ISNq=Nd#B2(z(+-N?iUbu2R@JF^o5
z%VM5g>7h5*$DEsZ*P(22@2o4CuM__S#`RrM=>0WAvUWzx?&X(NnD#8Ry_2*h@JXZ9
z>wK-y?N&u4w>=dS+hToK7B{XoXk1~y!^RvcE6m9FpM}YQ!GI6M;|K8oV_{}uZ!i!B
z@l{!PKp~~g#>mRb&dg|F3=$M%(J|0!BHkmiAWeKMVk{!Aj>+M3eC|i<9C-Rj{qCH*
z(^B?NGmr;KE3-%#h&71V-BGyN={BRiy50Upqx+^9(Hrh;AP0bhfrXigIfKC<mC2A{
z)4u%)lWwSOJ3V<vWSnUH3}InkjqTqhXUyB_mF;*?aJ@zK_fry@t1qvdKBNB9W;a15
z1J#@>a;NO%{!e4PI9<0Q{fH;?0ZsSq+X_WoqG$JO1W)1%t9NPNeC+s<b4M(uFgI5K
E0P|b7+5i9m

literal 0
HcmV?d00001

diff --git a/src/trust-fixtures/ev-g3b-aaa-emudhra.we-have-a-problem.com-1.der b/src/trust-fixtures/ev-g3b-aaa-emudhra.we-have-a-problem.com-1.der
new file mode 100644
index 0000000000000000000000000000000000000000..72065df22133f45343d9cfb99a05da6dae883bb7
GIT binary patch
literal 977
zcmXnKVm@oo#I$t*GZP~dlOV&59~p7}+Ba{gFs+D^k=t%)z{|#|)#lOmotKf3o0Y+!
z+K}6TlZ`o)g-w{r-N{heKoZ2^;1O~!N=+<DEmH7J%uCKlEiOqdG88c214**;um>mR
zq~#Z-7)lvPfJC@>1fBD9^HcH_oE;T>GIKLaQd0~S4dg*`%sdi~j*be>sYNB3X_?81
zC8-L*sYPX($*IK#a^k#3rUs^lCI(;-CC+PPVQ6G*Xk=_^X=)i|V2|WDKOaM313{39
zTs&N<zNIM{MTrVdVK5gn^9Z^6D!7Izg!lx5T%oJrZtP@GW+1@EuGQvo&X$Rhja9pm
zg+YlqiGfA+_KK*K%hPXh3k1D<6_V#s{r=UQxpOlX9DQ}?-}};Kv$tOR!}vw}_o=)s
z+-Fk`l+~I2zYsfph49f;JULShp3nLEp)DojqXnB2*U}S#E!=Xdst(U5JlPg<xK;0(
z*T)yBwTqh=O$?eC4ZtBFtIQ%{Al4wVK#)t>ZrVroH;>k9zHeGuf5BkM76Vx}=1^Ha
z7BLnPyE_UuJKbiqSGU{WXmsBcBYMM~4IJLG{EUqMSy-5v7}*SjK+1(dd=3LPM#le4
zj0_MXR9VCfMA$gA*%(<_*_j#PEG7d3kQN0NO#^iUb~e`ZMjl2+170?6Z8k<0#^ydn
zMg~+aQ-y&uNQXR&je(Vc#R9VhCT&I;B_#z``ufR5IeN+Ypm<JB1Tpj-9UYP46&9^}
z$wfH^CNL*3GO}nGs2Qlh_y&w^5>WH<lZy*L=H#d3LkvVqoPaSmF)}htcHO}k_9gSf
z|MN>Y-f<~~#m+e!)SkWX<Do5r4eYH|(N7}X_IAoJN-S7BOXzJB&zs;GQ?2KPuj$~N
z)XUhmA?1^Q%Y`=WS1<1#VHCETd#Ro;#Z7Y2|J3}-)DKS*Jgn!728q2$ThRPf-Ew6&
ztMSB-4}OO4y~LHipFN#Dz{YO&M4Q6%TY_vp-_iVDE$6vT^vO-zHy?h9p7C7h$2faI
z_??KiE=j`Y*Y?OB`6lSldLY*Ip^o!Zll=~!+dOrGY=nb&W^XPy8eF!yUO8%7Q{b}J
zOE;`re{6c!zV+UolQq?{tHM1)O|JNSoqGJpp-0wRLbk8X;Vfup41U4<XGg1#q~qDc
Fc>o*HLN)*Z

literal 0
HcmV?d00001

diff --git a/src/trust-fixtures/ev-g3b-emudhra.we-have-a-problem.com-0.der b/src/trust-fixtures/ev-g3b-emudhra.we-have-a-problem.com-0.der
new file mode 100644
index 0000000000000000000000000000000000000000..28c4fef550c3e880b1009d4cfc49324e5a71e64b
GIT binary patch
literal 571
zcmXnKVlp>qV%)cYnTe5!NyPSdqP6o42{x|HHv=AVl`6dCTc2#e#m1r4=5fxJg_+5~
z-jLgXlZ`o)g-w{r&&N>MKoG>?;^9j5EltTNN>p$PGn6)v1PL<p2)X(yxP~c&_yj9B
zJ1XcZxEnhe$cghBnHd@w85kItS{j>0iSrtn8<-jx8yFgx7@I{I=o{)9XhXECq?YNX
z8z<?e=7NpZD^JzUNGwa$P1G$Y%1_Ek&DBfJ&oziN5N2ZsyN`(x>QH7zc4j9AmT&%t
z0?fPm55)iSIrLW6EI!Ow>NWR`|3?lTZ^-*rm|DEBZkvne`sH^%#qwHADE|BJ=q{~-
zIkTrlKGTy}Fzv7n%i_l628~M$c-WXjWrZ0T|FbX|Fc|QGc!2SPcr46J><tFOAigRK
z4=9wh*%(<_*_jy)^g)7xEE)!CO~iRZ7NmiXMT|vceSC}H1DCL8k3%v}Z8_O<opbt^
zGy{2%v@(l?fmnlx-5rISoo+MQtK02wG`eq!5xwEg2C^I+1T4%<%;^jUDNF`Tr+;_4
z`}+KO?;$v6qHL|Vr|+J;49mw!TNLY)c|~5QmTFBfo!>c$`@Q({wNeL{R52NZ9aLOA
yE1Gq!*o6mQXHD4WofD~FdFfqNZEg;igqXS7e&He>jR@TZmD`SO%bEFy+Y<oG478{K

literal 0
HcmV?d00001

diff --git a/src/trust-fixtures/ev-g3b-emudhra.we-have-a-problem.com-1.der b/src/trust-fixtures/ev-g3b-emudhra.we-have-a-problem.com-1.der
new file mode 100644
index 0000000000000000000000000000000000000000..77d8e3e9f689b534287d0857e5a29eaf4096f982
GIT binary patch
literal 876
zcmXnKV$LvVVtTuPnTe5!Nr2(_5xIYpZm52UTh}7x)pXE+i;Y98&EuRc3p2Apm?5_T
zCmVAp3!5;Lr=Ov!fij50#UqpITbhzll&BDrnw*iBpOc@SnOdyilbM@YlA2<uU?2xl
z#>^w0nj4&%o~IC$pI@R7;uEak?5Lot;BIUnC(dhRYG7h)U}$DwY-|`M&TC>|U}9up
zXklz%U=U?sk7Tc(kD;)EAjm*29xj-@PGN@929h8_W*#9|Uj^4NWb>U2$_xb9*umal
zVq|00Ze(FlVoqXUQN6t)D&_L@TigOcFJFb^c~rlDHD~VJj0Hzu-TC*vblL2!*Zwem
z(f)lZZwvR?lmlgTX8$k5PG2E>bQMp|RD<VpzJ6#+$@pl&=ESx1L|_ZIoT{qB^9fJ3
zg&c0xyXN)rMQZKhCdR1-O^g!_<k^@*WtCYZ48$5l9$KwdtoiuZH)P$FqV0dXBb^i`
zgc!(z6!5W#v545+QMlRZHlw||-Tp?S`=%Jt8}4inX;l_60}(b3Z8k<$R(57aIE%?3
z2BceoCDb6;z><wyn~jl$vAIu?k%7@b%RmFBj)_rBCZnXJz)D}gD77HJII|?bs8TOA
zw>UFBPcJz?*MJvED^rC5I~!|yBM&2^K`G1xMn;xQgLDHG7~g=gO#*6SesXbvZW6L-
z_Hb29ZN^YlfMK;)KRLCiq*&k8*EKA}C)nB1-PlR5z&zQ&9ONl^76Su41Dyq03pCo)
zpr#}j<sez4Z(o$3Us94&oSc|$te0GrW55T}$j`|5pM`~)iIL4f2*ei#@i`3G7#aUF
zF)|>hYUWG^gES^XhA*@Be!nGU>9kOsOY?B;Bd+Wciz4-V9G4##&foFy;@@_a*gG1g
z7Y<BmR6OsT;PUoAlOe<2{#$n*>rc8QsoU}VXVR%za|PNq@q|C$B{XGsf8*4OM=N&R
Ssxr8L{)bFkm5NW3%s~KD+YH$N

literal 0
HcmV?d00001

diff --git a/src/trust-fixtures/ev-g3b-emudhra.we-have-a-problem.com-2.der b/src/trust-fixtures/ev-g3b-emudhra.we-have-a-problem.com-2.der
new file mode 100644
index 0000000000000000000000000000000000000000..76baf7160f57e167399b56a31de806559275cf44
GIT binary patch
literal 888
zcmXnKVlFXgV*0s&nTe5!Nq}LRl-+OP$nd-i4y;=;yrK=b*f_M>JkHs&Ff$uu8*&?P
zvN4CUun9AH`WXrv2!c4=!d$7j!I|lK3IX1phN=e2AVDr+nN;7>l#HT8g^<+bjJ*7u
z{PfJ!Vg;Yf+{}{H6hj3AIgm1DVR5KlS7&F1p#1z21!qSET?Kbz137VCBNGF2LqkJT
z6JukuC~;n6O9OKQOG67|0|SF7gD_Ob!0hEA&R!mvy<j^-e1hTjmKg}Jv4g$L#K^{~
z-N?eA#GJ&y63>6fes#Fmk$ufyH?zqvnDFTR0>-#D^V@dzEQVhsD_ZoobovWe`Kv{|
zzj(03=(@upZ;?NHl{mQqPc46-@o14(Y5UZRI+AZT3!KyGt``!q>}y+RwtpjIfzC4d
z5AMz}Jd2wcOAVSB3k~Gim_uciStJa^8boShnOcOeoavg~curhKPg8D=N3xTFEJy(#
zix`W@L#x$_H6I`QhOE0%wEb^)q?5vg5QwxYi<p538;3R<BP%OAGb5bEWMB)@t-xYt
zU}9jz#u6&4z+j+dpaE0B#3&|{QBqQ1rLSL<T999yS(0B=sh65toSB}dmz<w#PytiP
z$jFjokY%6*;~Oxxi9vPdCl?nW>v4grVQRC0ssRkE>H5j3MJ2`hkQCwS><o$<XGeEq
zz2u@217ncG<ymw<&Rw9kK&4FyYE*Jj4w7y5NSbmC_&}QY85#exurM<*vKa`0_`)DQ
zhXETS<9{YbM&uOEoXKF2#$?E_{X)l5!Ih7fusb$fVJkXy`1N~j|A*gxE}G(?;I~U;
z`nTosJ!NYPUv+3Z`iMW!FkirA$nY`C?aG#$B~08GLT0QMz31XK&sWD~;b)U;M(+0v
Z*K-!^{<76J;8WS+k}E%*ly5PM0s!Vt1#<uZ

literal 0
HcmV?d00001

diff --git a/src/trust-fixtures/ev-g3c-aaa-emudhra.we-have-a-problem.com-0.der b/src/trust-fixtures/ev-g3c-aaa-emudhra.we-have-a-problem.com-0.der
new file mode 100644
index 0000000000000000000000000000000000000000..06be190a8104f2e7c02f7191117fbe9ae0a93d02
GIT binary patch
literal 580
zcmXnKVsbEOVm!WpnTe5!NyO)<wzSEV-ws6{;o0T|+-d8Bmi;&2V&l+i^EhYA!pvmg
zV90I2$;KSY!Y0fV8f++HAOzxY@o=a5mZoGBB`SF4B^yc`NP<L}d4ybj6<os<LVSW1
zoE;T(72J)T4dldmjm!)Uj0_BnjEqc-qQrTP%neKpj17#8%uS4<42%s84fG+}HB!rT
z(~XmL6B844Q**)Q>y@YKW+axS>L%(I6y+!7q~_`+=jR$k8VIwogB{7l2z4zpBRjJb
z14~oDQr=y<I)QP?S5~f9`7!xk&9+~Uk`oTkUHoR2iB#p0ME3RF|4(=yUg)#^;pLA?
z?|a(PMf)4%@6KT}pIdNcGQ;A=)dr0#40za>LuG{-8UM2|888^|fq48N9$+lYOzaH?
z!XUmX3lAu$wAmP0S=pHx4U9p8f-E`)T1~`zL>8opk420{Wa^f*=dVSDuW9K7K5Ju+
z^Ig5pB-211B(2OMVIbBZvP?CuVWsc(&(mt8k59ZmY0o?F*YO|+fP;aBnTa`_!61dn
zK;iAaXodCR&s|vJU9F^#UuchQoD*X5{*vl$^OEG0lMxzkL(7ux70>B7FL>rs&(?`d
z1`6>PCT}vjFKDV?9%ZkRxOEBFEv|)Lua0lru4;bF_0gQ}2Y3B`vVQ)1^yMw3FAK_U
F0s!L(zGwgd

literal 0
HcmV?d00001

diff --git a/src/trust-fixtures/ev-g3c-aaa-emudhra.we-have-a-problem.com-1.der b/src/trust-fixtures/ev-g3c-aaa-emudhra.we-have-a-problem.com-1.der
new file mode 100644
index 0000000000000000000000000000000000000000..533cbaf527692f25ed869666af4c3dd6886fd8ed
GIT binary patch
literal 977
zcmXnKVm@oo#I$t*GZP~dlK|_7ic;M-&lm1)oqCyBtgz64myJ`a&7<u*FC!y2D}zC`
zA-4f18*?ZNn=q5RlcBVMB#6VoBjjF`npl!rq~M#Fmz<GWT#{O3C}6+`l4R#$4^GTU
z%P&eXlroS2iE!}<I_Kx+r{pU*J1Y2O=4O_prWh(3$b;mVc_bVi9Tl8Yi%K%nGLsWa
zQWb(zi^?*SQ;QAc#CeTO4NMJ948R~toY%<0(8$=($k^1<)H2Gz0m*Tp!G<CRLLd{l
zc(_x2OH(q65*0l2l3`9}<`HuBRd5Yc2=NI9IYU>$-PqZn%s_yRU8~LGoGlY08>@CB
z3xg7K5(A5F*bB{NznhMExlO;BuzsrCg!FY2f2v(}X1nFFV%6)4%x%l+a@C#kSe#Zd
zZ_bnKxc|*8(C^`S_OH9V?LRF@b6r<!c(pC-vee>BZm+ow%iqmBU7B`O>|9AhS6ctX
z4@c@xEpB2oF=%2m00)7rGK++PScAv{K`v#xX&>3&JX){$zG-Rw1%oA93}o4uLuL6`
z#8^a@sm3*|^xgh>T8;GaiT5Y%dFTB)9vtAZ{EUqMSy-5v7}>x9AS(>wa~QBOGX7^`
zWPli<$|7bU!p5P^#>mRb&ddmBF&P+uY*1j)G*CBSXJbuo<Y8nq;AP|1W@BVwZ0=KJ
zWI*LIRTwyfbjY*V7+4utEHGPO(q@!VQc_^0ub*6$qnDfyis<A-5JTV5(Ge+PVezV$
zT$E#A0&@Z*Ba4QCnt=+8Z@}0l0W~i_xwrsiPJT*0#6Yyv2^ez|BO^m&yqsE(m*wly
zISX7{E2>-^XXJg#J(%)Ha6-gkBZG)71&k`UpS#uDMNdB@rMT(U`PWm`E&Lh-#ouOi
z)UjQwiI%r*ywUUV;B381Q|BH$z;C6<w@Uo`+NHJoSL}CquHtK6d37<XX4cXw`Ld>E
z4vP0#%2ICXGj2M(=g)U_&$<n+i=+O}R8*e&P<~;I$z9vhl50U5=kC!GI-c?GpqZ0H
zvo>RPn*5g?E3R#tGgr-ivFC!*ej9s_&t-1P{2k)Xe07qgXvLGcp-R?y5z|t(mR*hX
z5c?FcWbw4k|4-QP7tUV3fLo1&L6>7StKN_9Y|YL44s}$jG)qebozyA|(aD%Kv3c?d
E06YOamjD0&

literal 0
HcmV?d00001

diff --git a/src/trust-fixtures/ev-g3c-emudhra.we-have-a-problem.com-0.der b/src/trust-fixtures/ev-g3c-emudhra.we-have-a-problem.com-0.der
new file mode 100644
index 0000000000000000000000000000000000000000..053ff83c2db022d562653792eb39abc367ea9925
GIT binary patch
literal 573
zcmXnKVzM-7V%)!gnTe5!NyPGurFrWyJ%#!^*#|FAJGmoE(pJ`hi;Y98&EuRc3p0~}
zgCVy8CmVAp3!5-gXt1G(fe?tp#lxNITbhzll&IjDmux6)APEv><`HuBRd5Yc2=NJ4
zaCTJCRd6?UHjoqNH8L|aFfuSOFts!`j}qrKGB+?aFg7qWFflfdGSD~FHPD7=S4l0?
zO*c-~P0a<Htyi9^n~_+Ss+*`=P?VpPlbWlSoS$nDX&}tT4t5|DBh;nLjO@%#3@jRN
zea#G5`93)EEK2>L6u-oi=UM*C_c4nk{|W3^JJ)S#x#Iqo&3;=;J>)MmzjA)@z$JEr
z<D8!p%-s7;S)T5)nz*=exk2L+10FW!P+4I{#{Vo#1`Gy#ARa$pARY@d6MKV!Fo>_p
z!UGB>Z8k<$R(57a1AUO7Ad7~9S`%@ekOgVrV-aH!SuMWr-I9IA!bM$8k*(a^PY$vi
zUTq)`l2&GsFc51HS*9A-u+n$?=V>+4$0y#OwCA1o>v)jm;2>aOW@64@Fi2%G;Qp}D
zqf7tbvDNpE)_#ze(SM@no~fdG>2BOXuXFszd6h~HUcB<j+<Uv};H&-V)7^hF88Vzb
zqaDdSBl-HKqD96(Hf}3jCiG(SoNe|^eGMvql-@Naf0UN0V0?8y>uvva+r(!E3;>78
Bx>NuF

literal 0
HcmV?d00001

diff --git a/src/trust-fixtures/ev-g3c-emudhra.we-have-a-problem.com-1.der b/src/trust-fixtures/ev-g3c-emudhra.we-have-a-problem.com-1.der
new file mode 100644
index 0000000000000000000000000000000000000000..09cff5669815c8c71d8164eeb910b9b328868a9e
GIT binary patch
literal 876
zcmXnKV$LvVVtTiLnTe5!Nr0h&b5d7|KpEqD)?fOPA2|)U*f_M>JkHs&Ff$v38FCwN
zvN4CUun9AH`WdPkD1$g$JTj@ir70Oji3%a9$r*Y1Ir-_Csl^IDnYo!IsVRmE267-}
z%sk?$xxty~c?v=K`6UV=KEVpkjtaU8?#2dk;=D$t1}4S^hNi}r#)eViye0+)CPo&9
z7RCk!22lnMNcM&X8;TeRfehs0;fC4knU`!RZ6FB}W#$ob^;K{UL$<)#pv*vkjUDU{
zCPp?^?M4;`CFUds7TvHHn#+DS9rJRVelubHRJjT1>n8qGyX?$%%VWi=*A<!Dmeu8|
zJLR!BtzzDsC)siTn^~aW!}IK4cX``?T9D?tuGa8sTh?W%#h2V(a~qbwn|Zo4?Wowf
zl7_Cd{)r!s)Sp`1#5mQUiE*NVJR5VUtTKy)fmnmcL#x$_H6I`QhOE0%wEb^)q?5vg
z5Cd6|0zMWo7LjGDaSbbdw||~iBYk}0{YiV?dB2W_NUO4l8HliPXtOc0va&NX!dXlP
zF(BOvETIO$29|8x+H8z0jLm(Dj0}thS_T?0bxe$6G8rW$1y=g{MX3e(#hE4fMU{G~
zxy703d3wqDxdyyQTA3;g*x6Xq8+jNR4N74qFfy`a8l)Sj!1xA?Z4yuu^OK7Ubd!-y
zvxlo<YBPqa0t~CY`pKz9CB^!#zOG>*KEck8?#9k~1?I^H<{(eWvltlY8R#s~TA<OU
z1~nzQC<n<Refy&P{F0KK;^f41W4+{}90NX(Mt(-d|12!bOpI*c)FLYk;&T|VF*5#V
zVq`#0*320U2B}O2?79VhHOC)?9`@Jm=f7LDVaNM<p}u#fot$~rQQ@G-N8|2^t?r$h
zWxkYeT2!$_RQ(x~A;YVO=8iI{Yo~nvAOAGw%MnA5jI0N`Cyy=I7VNrwe@dV9+3fuL
Rj4Mke?&Mg#_MW#_0szOz2fF|O

literal 0
HcmV?d00001

diff --git a/src/trust-fixtures/ev-g3c-emudhra.we-have-a-problem.com-2.der b/src/trust-fixtures/ev-g3c-emudhra.we-have-a-problem.com-2.der
new file mode 100644
index 0000000000000000000000000000000000000000..76baf7160f57e167399b56a31de806559275cf44
GIT binary patch
literal 888
zcmXnKVlFXgV*0s&nTe5!Nq}LRl-+OP$nd-i4y;=;yrK=b*f_M>JkHs&Ff$uu8*&?P
zvN4CUun9AH`WXrv2!c4=!d$7j!I|lK3IX1phN=e2AVDr+nN;7>l#HT8g^<+bjJ*7u
z{PfJ!Vg;Yf+{}{H6hj3AIgm1DVR5KlS7&F1p#1z21!qSET?Kbz137VCBNGF2LqkJT
z6JukuC~;n6O9OKQOG67|0|SF7gD_Ob!0hEA&R!mvy<j^-e1hTjmKg}Jv4g$L#K^{~
z-N?eA#GJ&y63>6fes#Fmk$ufyH?zqvnDFTR0>-#D^V@dzEQVhsD_ZoobovWe`Kv{|
zzj(03=(@upZ;?NHl{mQqPc46-@o14(Y5UZRI+AZT3!KyGt``!q>}y+RwtpjIfzC4d
z5AMz}Jd2wcOAVSB3k~Gim_uciStJa^8boShnOcOeoavg~curhKPg8D=N3xTFEJy(#
zix`W@L#x$_H6I`QhOE0%wEb^)q?5vg5QwxYi<p538;3R<BP%OAGb5bEWMB)@t-xYt
zU}9jz#u6&4z+j+dpaE0B#3&|{QBqQ1rLSL<T999yS(0B=sh65toSB}dmz<w#PytiP
z$jFjokY%6*;~Oxxi9vPdCl?nW>v4grVQRC0ssRkE>H5j3MJ2`hkQCwS><o$<XGeEq
zz2u@217ncG<ymw<&Rw9kK&4FyYE*Jj4w7y5NSbmC_&}QY85#exurM<*vKa`0_`)DQ
zhXETS<9{YbM&uOEoXKF2#$?E_{X)l5!Ih7fusb$fVJkXy`1N~j|A*gxE}G(?;I~U;
z`nTosJ!NYPUv+3Z`iMW!FkirA$nY`C?aG#$B~08GLT0QMz31XK&sWD~;b)U;M(+0v
Z*K-!^{<76J;8WS+k}E%*ly5PM0s!Vt1#<uZ

literal 0
HcmV?d00001

diff --git a/src/trust-fixtures/intermediate-0.der b/src/trust-fixtures/intermediate-0.der
new file mode 100644
index 0000000000000000000000000000000000000000..d200e0d704ca125e70f5b658898cdef407c93b6d
GIT binary patch
literal 876
zcmXnKV$LvVVtTiLnTe5!Nq}L=x@Q%ijFYw;c#^Qa=#z*67aNCGo5wj@7G`FHFhgzw
zPB!LH7B*ofPd`Id17#40i$^Baw=^ZAC{ZCKH8~?MKPNvuGqqU3Co?y*BsIlQ!9WhA
zjG0F~H8(gjJx?JhKfgpF#3xw6*-=4P!QI$EPMp`s)WF2pz|hpx#K0m-oY%y_z{JSH
z(8Acjz#z)N9?4!mA46dSL6Cu5JX|n)ox%*I4J1K=%sfJ_z6vg3$mTm4lo<%Hv4g$A
z#K^{~-N?eA#GJ&y@_gRS176dMj}*rR3d*jCI<z+~Wwp6?!$X}t3KnnV{Q0aK^-s3W
zlS^N}!B4;YWPM5NuGCc%<z6g#5}kDQ4D;3OXBC?d_iVW{xn_|YpK?p^iAj@VHLv(j
zd>F>I&F0*#Eg6fO7^fLDF-|g&XJZbPRc4Ve5Ni;5Xti3g=Hp}Ekabszw*T#pbW)fQ
zVjv4rz{euSBJxO1|GA8$C10p_(m@54a8s2oRS}4^DvOwb2pfks8zU<#J2NAk#bgi*
z(yhP}W)Nav$;PeC#>m3h+^5LMz-XXlpaE0I#3&|{QBqQ1rLSL<T999yS(0B=sh65t
zoSB}dmz<w#z>B1nDaC+;jV-;AhmncVpcG~VBO^<uLArqojBmi$CIK}vKe@O-HwoD|
zd$=m5He;wNz_41ZpPX7$QmpUl>k<~?6YT8hZtSF2V4iGX4)T>ei-CcjfzAT01sZK?
zP*akNa*!<2w=c@iFDc0>PEJfW)=MtRG2jDf<Y#33&%(mY#K>kK1mX*W_#6gojEw)8
z7#Wb0HFE}oK`N7hUN&2t-U^XJWs@Rh1dg8B#kXL;h*)Z-+#!W);U-4YlYX6F@Xqn`
zImI2NO}p;~Y&gVZ$Z&M_>FJ_Ud-C?GuTl3h*b^i6%A`d{eL>4jc3;c)7It@{Uk2`J
Rx;uI5r)W8ieHyn<0RZkv06zc#

literal 0
HcmV?d00001

diff --git a/src/trust-fixtures/intermediate-1.der b/src/trust-fixtures/intermediate-1.der
new file mode 100644
index 0000000000000000000000000000000000000000..48a42fa4dfab49e69e45fc7ad33ac8cc3ae2f897
GIT binary patch
literal 978
zcmXnKVm@ck#I$VzGZP~dlOV$amA_whrNvalJXxUNVG*(2fR~L^tIebBJ1-+6H!Fid
zwIR0wCmVAp3!5;LyOW``fh35-!6W2el$uzQTBP8cn3tT9T3nJ^WGG<32a;sxVGmBs
zNy{%vF_bcp0Euw%2s-EI=BMN<I6Er%Waeg;q^1}u8pwm>n0X`|9UT>%Q;SM6(=wA2
zOHvhrQ;W(nlT(Wg<ivT6Obtv8O$@*wN}Sio!qCXr(8$=-($q4_z#hqQem;i627(|H
zxp=rzeM?g^iV_u^!eB0D<`HuBRd5MY2=NI9xk6XL-Pp;X%s_yRU8~LGoGlY08>@CB
z3xg7K5(CTgc{dMuO)oxD92Y1kyCUk)-nf+2=H3ktb@nJ&ypi+gvu@Ns**Z@yef<VM
z{qB?XC9S(sS51_AvE)f~($zD}SF@j0Y(Ctx<<8`qMQ(h`Ex{)yO^(&P;y>|W7~3|R
zbGNo+EN)^nHE3cq1c!jEGK++PScAv{K`v#xX&>3&JX){$zG-Rw1%oA93}o4uLuL6`
z#8^Zg$>~3rk+kFs^-emdpb~DX(xoZ_4sTh0M#ldvEX+)dYz9Ig<-#C7hXETS<9{Yb
z28a==EMf*CY#iEbjI6Be%#3grlYt>fivo+5frbGG8(VrK4<i$!0WTZ3HX9=gV{@M(
zBLgazDaF7Uq(z>^#=y$JVu9HLlQyG_l9B=|ef{L39KGaxP(&vuf*AUaj*dtX3yW91
z<f0q{6POzq8Cf(8)C^Q$d;`Wd38;Db$;AaAbMjO2AqJwQPQaL(7#SIgor5%1P0!eJ
zZh_dA3g<FyE%kG{&lW!|eK#*WGsORWTJ7W`x|=SY*GN*j_@trb(9&=Zxw9{XO^xRF
zcK$n=C-zP03`4C-g_5St4_PI*jNMbac&Do~HB>y?WV|eOjgOP_v)%&EoV@slai&(M
zPo|~pp3?jJLic(B)9^b9lGm%$Uo@$CoiEC{<?g)MX_d3Ud&VC-n75YQay@y1)AQmj
zju-BIy9{rL+>qFw8MMtHxsZ>^GV-J2g3Z#_Gx9gCdaRmr*IU%3psrHX;P2%>1|I2u
z*4%#SE3V^pC(>cv){6hWCOa*!vPb%TYV31u4_{~(D(N$k!-=^iE|}H3OT5v1;@?C7
DSIjim

literal 0
HcmV?d00001

diff --git a/src/trust-fixtures/intermediate-10.der b/src/trust-fixtures/intermediate-10.der
new file mode 100644
index 0000000000000000000000000000000000000000..09cff5669815c8c71d8164eeb910b9b328868a9e
GIT binary patch
literal 876
zcmXnKV$LvVVtTiLnTe5!Nr0h&b5d7|KpEqD)?fOPA2|)U*f_M>JkHs&Ff$v38FCwN
zvN4CUun9AH`WdPkD1$g$JTj@ir70Oji3%a9$r*Y1Ir-_Csl^IDnYo!IsVRmE267-}
z%sk?$xxty~c?v=K`6UV=KEVpkjtaU8?#2dk;=D$t1}4S^hNi}r#)eViye0+)CPo&9
z7RCk!22lnMNcM&X8;TeRfehs0;fC4knU`!RZ6FB}W#$ob^;K{UL$<)#pv*vkjUDU{
zCPp?^?M4;`CFUds7TvHHn#+DS9rJRVelubHRJjT1>n8qGyX?$%%VWi=*A<!Dmeu8|
zJLR!BtzzDsC)siTn^~aW!}IK4cX``?T9D?tuGa8sTh?W%#h2V(a~qbwn|Zo4?Wowf
zl7_Cd{)r!s)Sp`1#5mQUiE*NVJR5VUtTKy)fmnmcL#x$_H6I`QhOE0%wEb^)q?5vg
z5Cd6|0zMWo7LjGDaSbbdw||~iBYk}0{YiV?dB2W_NUO4l8HliPXtOc0va&NX!dXlP
zF(BOvETIO$29|8x+H8z0jLm(Dj0}thS_T?0bxe$6G8rW$1y=g{MX3e(#hE4fMU{G~
zxy703d3wqDxdyyQTA3;g*x6Xq8+jNR4N74qFfy`a8l)Sj!1xA?Z4yuu^OK7Ubd!-y
zvxlo<YBPqa0t~CY`pKz9CB^!#zOG>*KEck8?#9k~1?I^H<{(eWvltlY8R#s~TA<OU
z1~nzQC<n<Refy&P{F0KK;^f41W4+{}90NX(Mt(-d|12!bOpI*c)FLYk;&T|VF*5#V
zVq`#0*320U2B}O2?79VhHOC)?9`@Jm=f7LDVaNM<p}u#fot$~rQQ@G-N8|2^t?r$h
zWxkYeT2!$_RQ(x~A;YVO=8iI{Yo~nvAOAGw%MnA5jI0N`Cyy=I7VNrwe@dV9+3fuL
Rj4Mke?&Mg#_MW#_0szOz2fF|O

literal 0
HcmV?d00001

diff --git a/src/trust-fixtures/intermediate-11.der b/src/trust-fixtures/intermediate-11.der
new file mode 100644
index 0000000000000000000000000000000000000000..533cbaf527692f25ed869666af4c3dd6886fd8ed
GIT binary patch
literal 977
zcmXnKVm@oo#I$t*GZP~dlK|_7ic;M-&lm1)oqCyBtgz64myJ`a&7<u*FC!y2D}zC`
zA-4f18*?ZNn=q5RlcBVMB#6VoBjjF`npl!rq~M#Fmz<GWT#{O3C}6+`l4R#$4^GTU
z%P&eXlroS2iE!}<I_Kx+r{pU*J1Y2O=4O_prWh(3$b;mVc_bVi9Tl8Yi%K%nGLsWa
zQWb(zi^?*SQ;QAc#CeTO4NMJ948R~toY%<0(8$=($k^1<)H2Gz0m*Tp!G<CRLLd{l
zc(_x2OH(q65*0l2l3`9}<`HuBRd5Yc2=NI9IYU>$-PqZn%s_yRU8~LGoGlY08>@CB
z3xg7K5(A5F*bB{NznhMExlO;BuzsrCg!FY2f2v(}X1nFFV%6)4%x%l+a@C#kSe#Zd
zZ_bnKxc|*8(C^`S_OH9V?LRF@b6r<!c(pC-vee>BZm+ow%iqmBU7B`O>|9AhS6ctX
z4@c@xEpB2oF=%2m00)7rGK++PScAv{K`v#xX&>3&JX){$zG-Rw1%oA93}o4uLuL6`
z#8^a@sm3*|^xgh>T8;GaiT5Y%dFTB)9vtAZ{EUqMSy-5v7}>x9AS(>wa~QBOGX7^`
zWPli<$|7bU!p5P^#>mRb&ddmBF&P+uY*1j)G*CBSXJbuo<Y8nq;AP|1W@BVwZ0=KJ
zWI*LIRTwyfbjY*V7+4utEHGPO(q@!VQc_^0ub*6$qnDfyis<A-5JTV5(Ge+PVezV$
zT$E#A0&@Z*Ba4QCnt=+8Z@}0l0W~i_xwrsiPJT*0#6Yyv2^ez|BO^m&yqsE(m*wly
zISX7{E2>-^XXJg#J(%)Ha6-gkBZG)71&k`UpS#uDMNdB@rMT(U`PWm`E&Lh-#ouOi
z)UjQwiI%r*ywUUV;B381Q|BH$z;C6<w@Uo`+NHJoSL}CquHtK6d37<XX4cXw`Ld>E
z4vP0#%2ICXGj2M(=g)U_&$<n+i=+O}R8*e&P<~;I$z9vhl50U5=kC!GI-c?GpqZ0H
zvo>RPn*5g?E3R#tGgr-ivFC!*ej9s_&t-1P{2k)Xe07qgXvLGcp-R?y5z|t(mR*hX
z5c?FcWbw4k|4-QP7tUV3fLo1&L6>7StKN_9Y|YL44s}$jG)qebozyA|(aD%Kv3c?d
E06YOamjD0&

literal 0
HcmV?d00001

diff --git a/src/trust-fixtures/intermediate-12.der b/src/trust-fixtures/intermediate-12.der
new file mode 100644
index 0000000000000000000000000000000000000000..e5bd32bda3f264fab5afe29278f74de856dac850
GIT binary patch
literal 863
zcmXnKVvaUwVtTNEnTe5!iN8W(vVDK+mc&`wroUI%av5;3acH%9oU>(NW;O^l<Tl`B
zV-96u6K3-CGgLKD264D}WKw-gQ!<JY6+%*zGxG9t^3yX@ixqq_b2Cd)Qw-$|WI@W9
zdBjq4gEQ0f6oT^eOB9@g6`UOvbQRo<4dldmjZ6(pj13IU3@nVyqr`bl3=B++EDSA-
z4GavT4D67s_46?lHV_1v$Hl`1v(_ohP|838B*@Go=<2KBABJSSlR=q*02@2l6HJV3
ztlEt%3`)#N3@od5^KVGYI)9$=*H!I5e|@w+owhNVey?~cUxef~`Dar(+Z|6Fndm&*
zWP!8H`hU?sw;Vk2VjTnH&o6hnZs<gQPM$aIY>ut(hI9W8<=7?#R-2az7nRueb=@uB
z$dK}B_0tCdi<=m`4VoC+4dmIFLuHj&Bn-qFL^4X4f3%+J4G9RB6?<^vo-6O_v%28$
zk>z6%V-czR_2SL>+q|W{OCqk#-}d%Sjpw~*2Eriysw_O9xX@-}WMyS%W;Tce2`aFJ
z8-yBIvT<v(F|sf=_bD<mFdAqXXs~fW)G;xN$z+t26j<r&7o`^D7iX5_7gg$|<`!qB
z=jkQq=Nj;_@xZk*HF_9uu(72#@-VV68kE4yU}R*;Fi0~{f$<F(+a#c7<|h{y=q4eX
zX9ris)Mf-2R25d6^^;SJN{aPeef`6ngPk4Sjh*xg%##hwK)#Y^(KpaF&|aXqK)p>B
zYDjWX4w60k_C@*mCCSCfiRs3A$wfH^d?0=NjEw(TSeTg@*$jk0d|?ou!+?#E@jnwI
z11R*siGYQfnK_feAdSh8VgI?k<_V768!oLn>+OE?s%v*clty^by8XYT!#$$rb1_Ef
z9L|6DC}vY$D|3c^GT$dALx#PwHYvN$>6+HZ&M00hzpd%U?foiem3{wp^-j=V^r7>-
V^;d<^NoiBP)6_oAIdt7>GXVC<22KC~

literal 0
HcmV?d00001

diff --git a/src/trust-fixtures/intermediate-13.der b/src/trust-fixtures/intermediate-13.der
new file mode 100644
index 0000000000000000000000000000000000000000..8c3565fe4cfd3b4f189e4edfd58d4714f06bae7b
GIT binary patch
literal 967
zcmXnKVm@rp#I$+=GZP~dlYrx6?cy~Ou{jT}dvLG$;g@N^%f_kI=F#?@mywa1mBFCe
zklTQhjX9KsO_<5u$xzxr62#%)5ppj|O)N<*Qt(a8OU_6wE=esi6foceNwV{>2PfvF
z<rk$GN*PFiM7Veao%3_^Q}Pv@9Tj{sb2Cd)Qw$Xi<Uw-GJQ9wMjtb7HMJ1VOnaPPI
zsS3fVMP-@Esl^6z;=D$t2BwB424D~+&TC|0Xk=_?WNd0_Y8ho<hvYavA46dSL6C`D
zJY1>1r70Oji3(0(Fefnc2)g<z_=hPt2ZJ1;tKe?zWKd=xz{alC=5fxJiII&}yOD)K
zi8+aZWz}x}4QW~D&olnIs{QA$kM^h2HYU^W6;I`hklZH!Y$|8F<B1~^ooAaYaF$vB
zFZ$<}gC}0BV_^LG<xbZPoygD0^QN86vGv_>?%$yt+oZs1^D^P068pZcyX6}hQa-JI
z`XFF&6Qhnn6Qc$=0A!U}Bn-qFL>35gDceo^$o}Thdd>GuOY1KfEZJfp%f=ik%f}+d
zB2xM5#hdfDc}shjL|mJ{?d_c!&wJ0n!7a<r$oQXyg_((w%|HmGTo}aXFkoY3{LjS5
zU?2<<Q)S^X;9}#@W@BV!WoKqKFailGuxJ}-8gQ_&r8n|0vM?I(vT<v(F|sf=_bD<m
zFdFc&@xZxEjUEQhAU*OdHU?G(77NT4n6w#Xl#~=$>FXyK<>)2ngQ7P%5ya4UbaX_D
zPFQT}B^Tuwn7|yt$jG8$pk|-~;~OxxNkGlZPcAM1nUkNA4>1reO#;T;#K_2?B+GX;
zTb8vW;{BVAHaROc3jN#Z();?ec6qHl+bg}MbFQH&=7kd6EuG5)J;WKzZ1Y|(h!R$-
zwY_uFFZjyA@YI5(98J%jr9b%9wd|j!NW{!?X7z7U-{fz+-}mazt9_n7uAe;dWLNBV
z=iPdGWe;2S-%)et;oqFf_j*lLWE_jFTviREi-lPEEGgrtIZ+bF)Cv#iOnYvp_lAq>
z;?BOXMQaNTGeYkC{QYpRZ^Owl(Z0B(u4b!=i-Wl?{J3@I%5Q_jSCfkW-qq>}nVT@P
z{*`G?#MTGO(>_Mc<#9Bv|K}^?-1jg?pm_fq=~rHpIEs8l1l%8;6RtUPD@=F0s?gGe
I=^o}^01@UwSO5S3

literal 0
HcmV?d00001

diff --git a/src/trust-fixtures/intermediate-14.der b/src/trust-fixtures/intermediate-14.der
new file mode 100644
index 0000000000000000000000000000000000000000..73d39b2879870e00ba9c258118a4b5499fd0428d
GIT binary patch
literal 863
zcmXnKVvaUwVtTlMnTe5!i9f`<ev*#iIwdZzNt$Bco*8hlacH%9oU>(NW;O^l<Tl`B
zV-96u6K3-CGgLKD264D}WKw-gQ!<JY6+%*zGxG9t^3yX@ixqq_b2Cd)Qw-$|WI@W9
zdBjq4gEQ0f6oT^eOB9@g6`UOvbQRo<4dldmjZ6(pj13IUj4ezIqQrSk3=B++EDSA-
z4GavT4D6At4GlIFF%SZo$Hl`9v(_^&*-*+r0wl`JBk1a@;2(x$zOzA@fdCsj*cVKU
zY^>UiEDTD_NenDIKRifwXIeIA*{ZuPHh+_jNY7rfiBl!BwzA}Trj$_r&aB^dCWro7
zAN|tICa)HIXlaX?NwIPui`k}rmd|a<$!wJkj{@wNf^}2fl%on$7ey|7@0njB9e?k6
zMG?o79lzc$Zer{<Xku(PkY{5Kl~rbuFc51H$tYp|(R!*kBp_T??7@k9uDq+y>VgAE
zmXAe@MdV$6v1V`n{^gsc4^K7uCK~2ak+$7H7^Gj7g$EQF+H8!htnAFp25}%k1(tAw
zPy<UgZf!P37RKg2MMefj11$p$HV%k7CPp!tjFOT9D}DW<)Pnrt%#!?~O1;$F;>`3s
zz2y8{13oq$xK^e{4+9Q1w)93GMixec5||l`j4T-jX$C4Vz5!#K1k}v@<l+L|WMuQ~
z;HsF~05gKB!fLaAa%xdYvA(OXf0%Qyv!lDQvtEIDvVj@MSMn_S2D%2?3p5v~x2Zx6
zNiNDkvPa*(C_ld>xi~p7-B>TVD93;gq>rDG@jnX-GZP~lIEly#gZLZ<Y>bTmnHU*B
zp$AR`EX>Tz84L!gOoj}fl^=XM`PNG4LwJg~`lKTnOI9xa{#>}auhDF-_TKw^GK;%b
zeNpOn3wt7*w7@@?cQTVfLe&G!86rDAuU}N9Yd%%#<@Neld%h*NPdt{meQg7)HFI#y
Ti@C)%Q=NrX-G3D`MCbwlTQ>T=

literal 0
HcmV?d00001

diff --git a/src/trust-fixtures/intermediate-15.der b/src/trust-fixtures/intermediate-15.der
new file mode 100644
index 0000000000000000000000000000000000000000..b991e83c61164df69553ae5d46279803576ad137
GIT binary patch
literal 969
zcmXnKVm@ln#I$w+GZP~dlOV&jrSB81E%}Y!&$(|hzg)x7fR~L^tIebBJ1-+6H!Fid
zwIR0wCmVAp3!5;LyOW``fh35-!6W2el$uzQTBP8cn3tT9T3nJ^WGG<32a;sxVGmBs
zNy{%vF_bcp0Euw%2s-EI=BMN<I6Er%Waeg;q^1}u8pwm>n0X`|9UT>%Q;SM6(=wA2
zOHvhrQ;W(nlT(Wg<ivT6Obtv8O$@*wN}Sio!qCXr(8$=-($q4_z#hqQp}~eC20|bc
zxp=r!eM?g^iV_t(^O9k1VCE5Y^;Pf>Q*aIjxk6XL-PqZn%s_yRU8~LGoGlY08>@CB
z3xg7K5(CT54-b;vnU>92w(72n&EKRW(zBOr;#A43tt@$-DJ7J@GwZjV$)Ug2N53?)
z$*aX4TH0b}Qmh=vVz#ND<#U^IGFxTCqX0XmVBJ(V<*35cMUe~Nd*+u&$KQKiQN;0N
z$FKK`n;3Nrniw^}At0;FB4HrbAhJM^OWAJPNA@?5)@#0RT3Ua>V96E(SvKZSSw0pq
z7Lj-P#hShO`<HK)K0MXrn`oFzMcQ_7c+2uLGX7^_VP;}v1N&cA7{uo=U}I$b&&0@J
zAPh1>m4(NEi;Y8@jggg=otfFd2qdV$qHUmQz`@3r-pIqq!f3$D#;wi9$imp%r^v{_
zXu!wD1Lra|dKfr^^vJW=7+4utEHGPO(q@!VQc_^0ub*6$qnDfyir?f!5JTV5(Ge*=
zVbQ6VT$E#A0&@f-Ba4QCnt=+8Z@}0l0W~i_xwrsiPJT*0#6Yw}2^ez|BO^nC<hD8!
zOZ6L3KTA||{?Dy@dE{q@^Z9G16Q<S)E2m1C$$QWEp1NK1!`)L?KQZmpKe4a;$s8%Q
zqo=*3w+No~3lHaGdd^T}oLu>D>G4fkcIR#`-^<zgY1g|zHuZbTr8l&C#Drgo&kby~
z)@9nGRIhg2|K&1;1!{X+G7luFOE@z9GI%VIKKWhik)BWY6gqldFXK8g(fRM4G?uD_
zV^8NZCNr)1?CD*}>^PspKBTC;!?AwxIl<T-?P;4<slWZs?O(BY(b+C%POimWf794g
zRchij;y<JwWwOgmdt}9WDz7=UUU<ijTlRcx;$}}5NANA$$L_T(|E^BYRmSFO&q^if
H|MP1BoxU`Y

literal 0
HcmV?d00001

diff --git a/src/trust-fixtures/intermediate-2.der b/src/trust-fixtures/intermediate-2.der
new file mode 100644
index 0000000000000000000000000000000000000000..ded8f517c2001ceb868112089213ab5f314f1dbd
GIT binary patch
literal 874
zcmXnKVooz?VtTuPnTe5!i9cuU;`HA#0t_8Oe2bW_W*Bg>acH%9oU>(NW;O^j<Tl`B
zV-96u6K3-CGgLKD264D}WKw-gQ!<JY6+%*zGxG9t^3yX@ixqq_b2Cd)Qw$Xh<Uq=p
zdBjt5gEQ0f6oT^eOB6zUf)$({6?7HcjSb|)d5ugBOpFZ-%?u0-jiSVPO$-c7j4TW-
zj13G7q73Yj?Dg|86gCh98OX)M1+&*F%uw1u5+umXBjoC<;2(x;zLP<jfdCsj*c(iY
zY^>UiEDTD_NenE-omC57+x$J%E##p8>%;0J4;8i7_r5FdI{8jFcZdBN4W2mG<gVw7
z)?Ak{(&{slxwrG%9A~DTcYBL3p2=CY=?vF9KgFDvm3ITXyuNHxdz#^MH?_h1El;bT
z&p~~kA1S%Ki<=my88k6YGLUCu4wY4AkuVTz5P4{|TCwKiW8aW<SBkd(?T&O(m=Izh
z3sS(xBE}*z`$lTu`sdGe%-3?f%apvi-@IiV7erc>Ma)2ijYFG_k(HI5nGw!nGKdA~
zR$vJ;2r;l^<JM+lWMORXQ)FadG|)28fT?3*6qCs)DJihh*Dp#f$S=+;$uFwZOU*6L
zOwZFx&d)XAMbgTYXTZV6mfpz2$i!q&3NwO{ktNe0-9QD#H(+d&fEt;fTwI`=glwEW
zToqHBF<?+tSS{91PAw`a)_3*w4-4@Lc6M|(cG4>_Pc|?I`AVL}z(CJHXMxrNjW#u?
zDal1SNEYea7v<-dl;jjAC#D<gB^Tuw@PRb)Gcx{XVPR%sWHS%~@r6Nr4g)qu#{W!=
z49LlvIi0~Eg~`BS@;k?FbI-Po%=g)TizhC7yS3xBd#dSO>t_{;{wc5Bo5M6`d!`<{
zbNfu8V*go-OH2lF%WQ8eFFLkr)<>SGMRVBX^fz>0_gHzMf0oU;jgF6+CjDG4)7x_I
PgU$C`j$6C_?A;9jIavo;

literal 0
HcmV?d00001

diff --git a/src/trust-fixtures/intermediate-3.der b/src/trust-fixtures/intermediate-3.der
new file mode 100644
index 0000000000000000000000000000000000000000..b3da3b9bd2d6eb2955f9ec195597895d5467b2a9
GIT binary patch
literal 978
zcmXnKVm@ck#I$VzGZP~dlOV%OC*{2_^(Xp8?Oe0^?;3Lf170>xtu~Lg@4SqR+^h@+
z)rQ;#oNUaYENsF|?oNi%29h8S2ak|@QEFmIYLS9(VqS7aYH>+wk)ePAA4rm&hdnqk
zCoR7y#ZbyX0wlu4Bj}u;o1c=e;Owa2lbM@YlA2<uXdn-gW9E@?baYg3PAw|QOv_A8
zEJ;-ePAw|SOinE}kQ3)MGBq$YG%)~!C~;mR3qvDgLnC8TOH<1z1A8RL`S}<M8wi3-
z<l^B<^({@wC`wdt3WK?rnMcUgSHV9_A;c#b<O*E{cVj1mG6MlNcC9v#bGA&3Y^>Ui
zEDTD_NenE-omC57+x$J%E##p8>%;0J4;8i7_r5FdI{8jFcZdBN4W2mG<gVw7)?Ak{
z(&{slxwrG%9A~DTcYBL3p2=CY=?vF9KgFDvm3ITXyuNHxdz#^MH?_h1El;bT&p~~k
zA1S%Ki<=lt4VoAY!66{4%pzeR)*!M#kW1Na+DG;`kJf9xZ(3S^!C=W216elaP+2|}
zF&2^8H&O%FKYy-czLw)%rsU22<}K^Ez~L>+&&c?ng@u`kk<CB|q+A%p=P+PnWc<&>
z$N(`yl|{@zgpEU+jggg=otY8NVlprUX;EO&GSD#KU}H;f<Y8oDGT>$7)@Ea5VQlVG
zWMp7O;WFhJID@pvv)C9|8CWbZTVT>=lu=SrV5P60T$H1ioDYiV<U|ld-_g+#DPm#q
zs+U}pV_*Vv10y4ghJl)a3XE^S*d_rrFF(1s0Ax;nN<PFuwA2Y0a}y&Y1GiiAq<uaY
zvtRo@mALmc&#kk(e$|ON<(I3ZDoQ*Pc89CB|EQUxv_M@%St8x?G3Uc|n>t$)3N3Cb
zUR!_8lc(*$dA&_{FYoBS`S-9x;d`y?5n_kWgzO1pF#q9Z!NvD!)-9&H!sk?@qhgD1
z{$4Ns*-zohiGTM#Op>!*YVtLqsF&}o5}*2~p5~BRgAFMiYi{SbI7m*s*W1g^CMNrS
z5r^sIn)AyJnyx4dyclup@S+WSmfNzbEQ(v;vU}O(JbQ7|R1SsvbG_HB^ZGY~{XEl$
z|DpS(+a_4|cE>GyYIiG1)=T2&l%4s^Y?*EKo0jIx+10!8l7HINJKxF{+0GMKl>Fqf
H!sCemV@5)!

literal 0
HcmV?d00001

diff --git a/src/trust-fixtures/intermediate-4.der b/src/trust-fixtures/intermediate-4.der
new file mode 100644
index 0000000000000000000000000000000000000000..77d8e3e9f689b534287d0857e5a29eaf4096f982
GIT binary patch
literal 876
zcmXnKV$LvVVtTuPnTe5!Nr2(_5xIYpZm52UTh}7x)pXE+i;Y98&EuRc3p2Apm?5_T
zCmVAp3!5;Lr=Ov!fij50#UqpITbhzll&BDrnw*iBpOc@SnOdyilbM@YlA2<uU?2xl
z#>^w0nj4&%o~IC$pI@R7;uEak?5Lot;BIUnC(dhRYG7h)U}$DwY-|`M&TC>|U}9up
zXklz%U=U?sk7Tc(kD;)EAjm*29xj-@PGN@929h8_W*#9|Uj^4NWb>U2$_xb9*umal
zVq|00Ze(FlVoqXUQN6t)D&_L@TigOcFJFb^c~rlDHD~VJj0Hzu-TC*vblL2!*Zwem
z(f)lZZwvR?lmlgTX8$k5PG2E>bQMp|RD<VpzJ6#+$@pl&=ESx1L|_ZIoT{qB^9fJ3
zg&c0xyXN)rMQZKhCdR1-O^g!_<k^@*WtCYZ48$5l9$KwdtoiuZH)P$FqV0dXBb^i`
zgc!(z6!5W#v545+QMlRZHlw||-Tp?S`=%Jt8}4inX;l_60}(b3Z8k<$R(57aIE%?3
z2BceoCDb6;z><wyn~jl$vAIu?k%7@b%RmFBj)_rBCZnXJz)D}gD77HJII|?bs8TOA
zw>UFBPcJz?*MJvED^rC5I~!|yBM&2^K`G1xMn;xQgLDHG7~g=gO#*6SesXbvZW6L-
z_Hb29ZN^YlfMK;)KRLCiq*&k8*EKA}C)nB1-PlR5z&zQ&9ONl^76Su41Dyq03pCo)
zpr#}j<sez4Z(o$3Us94&oSc|$te0GrW55T}$j`|5pM`~)iIL4f2*ei#@i`3G7#aUF
zF)|>hYUWG^gES^XhA*@Be!nGU>9kOsOY?B;Bd+Wciz4-V9G4##&foFy;@@_a*gG1g
z7Y<BmR6OsT;PUoAlOe<2{#$n*>rc8QsoU}VXVR%za|PNq@q|C$B{XGsf8*4OM=N&R
Ssxr8L{)bFkm5NW3%s~KD+YH$N

literal 0
HcmV?d00001

diff --git a/src/trust-fixtures/intermediate-5.der b/src/trust-fixtures/intermediate-5.der
new file mode 100644
index 0000000000000000000000000000000000000000..72065df22133f45343d9cfb99a05da6dae883bb7
GIT binary patch
literal 977
zcmXnKVm@oo#I$t*GZP~dlOV&59~p7}+Ba{gFs+D^k=t%)z{|#|)#lOmotKf3o0Y+!
z+K}6TlZ`o)g-w{r-N{heKoZ2^;1O~!N=+<DEmH7J%uCKlEiOqdG88c214**;um>mR
zq~#Z-7)lvPfJC@>1fBD9^HcH_oE;T>GIKLaQd0~S4dg*`%sdi~j*be>sYNB3X_?81
zC8-L*sYPX($*IK#a^k#3rUs^lCI(;-CC+PPVQ6G*Xk=_^X=)i|V2|WDKOaM313{39
zTs&N<zNIM{MTrVdVK5gn^9Z^6D!7Izg!lx5T%oJrZtP@GW+1@EuGQvo&X$Rhja9pm
zg+YlqiGfA+_KK*K%hPXh3k1D<6_V#s{r=UQxpOlX9DQ}?-}};Kv$tOR!}vw}_o=)s
z+-Fk`l+~I2zYsfph49f;JULShp3nLEp)DojqXnB2*U}S#E!=Xdst(U5JlPg<xK;0(
z*T)yBwTqh=O$?eC4ZtBFtIQ%{Al4wVK#)t>ZrVroH;>k9zHeGuf5BkM76Vx}=1^Ha
z7BLnPyE_UuJKbiqSGU{WXmsBcBYMM~4IJLG{EUqMSy-5v7}*SjK+1(dd=3LPM#le4
zj0_MXR9VCfMA$gA*%(<_*_j#PEG7d3kQN0NO#^iUb~e`ZMjl2+170?6Z8k<0#^ydn
zMg~+aQ-y&uNQXR&je(Vc#R9VhCT&I;B_#z``ufR5IeN+Ypm<JB1Tpj-9UYP46&9^}
z$wfH^CNL*3GO}nGs2Qlh_y&w^5>WH<lZy*L=H#d3LkvVqoPaSmF)}htcHO}k_9gSf
z|MN>Y-f<~~#m+e!)SkWX<Do5r4eYH|(N7}X_IAoJN-S7BOXzJB&zs;GQ?2KPuj$~N
z)XUhmA?1^Q%Y`=WS1<1#VHCETd#Ro;#Z7Y2|J3}-)DKS*Jgn!728q2$ThRPf-Ew6&
ztMSB-4}OO4y~LHipFN#Dz{YO&M4Q6%TY_vp-_iVDE$6vT^vO-zHy?h9p7C7h$2faI
z_??KiE=j`Y*Y?OB`6lSldLY*Ip^o!Zll=~!+dOrGY=nb&W^XPy8eF!yUO8%7Q{b}J
zOE;`re{6c!zV+UolQq?{tHM1)O|JNSoqGJpp-0wRLbk8X;Vfup41U4<XGg1#q~qDc
Fc>o*HLN)*Z

literal 0
HcmV?d00001

diff --git a/src/trust-fixtures/intermediate-6.der b/src/trust-fixtures/intermediate-6.der
new file mode 100644
index 0000000000000000000000000000000000000000..8fe252037d13cf433becf937b74f68930dd6e273
GIT binary patch
literal 876
zcmXnKV$LvVVtTiLnTe5!i9e!S&qjO4*@bpeLY%73iUwS499nH2=WJP+nGM1WxeYkk
zm_u3Egqb}33{?%3K^!g~nN;7>l#HT8g^<+bjJ*7u{PfJ!Vg;Yf+{}{H6hj3AIgm1D
z9`V%N;LP+qg`oWW5`_?-U<GGK1ziPqV*@#HUL#Wj6JrBIQ)5#D%P4VP69WSiBMU<d
zV*>+&C<6y1dqaZ_MGS;M26FLm!|e6UOE#1?kOYY`^9Z^6D!7CpTi|R^W+1@E4)zBV
zBO9xBBMXBPa}ooKRaHgOi6g#7zIQX3t<swgynpx4A@o_7ko^L4>BV~|P6_mTShU3W
zaWX&CUWo?tn@>gN&n~|`Wl`h(8P)o)I=V~t{_DTxBQWz_&cdl_|Li_I{kCCNXwI4L
zrL2kfrL|mS85cJ(PBUm?oMa%+#vCfE%pzeR)*$lGYPDj`$H%@Q>#h`S|Jxnuq%a}G
zKo+Eck420{WL=#=jE&~BgDc$CStCC_u)Xq>>oY`Jl|{@zgpEU+jggg=otY8NVls#Y
z=~iF~GYB!TWaHLmV`O1$?o(uBU^LJ&(1599Vic3fC@Cqh($_CaEyyp<EXgmb)Jx4R
z&P>nKOU}<V;6>8Plw!ca#+Kg5!^p&FPzp1Gk&z|SAl*O(#y4PWlYknTpIls^n~ZFn
zJzN!2n=w=sU|22IPfjf=Db{!ObqNdc33hgLH+I%5Fi$ox2l+~##lS$%Kxcv00*y8`
zs42-sIY<`i+ZW~Mmz3lbCnu&G>m?WE81R8K@-s62XJKJxVq^m+7g=EtpTmHSk?}th
zBLi}}X3k(RNM$l)ILLdWv}fV5cae9tme;<NUzBO|`G5F_6W){Grtbdgyyd#!p6p_s
zgj3IBEoRFk7<o=%GGOm!zakawdEoQJ3qQ6@2s*TJ|CKW}x4!*JTr;UkIB$3S)`i8f
R3{D#|=BkC8%sHLE3jpY*2ABW<

literal 0
HcmV?d00001

diff --git a/src/trust-fixtures/intermediate-7.der b/src/trust-fixtures/intermediate-7.der
new file mode 100644
index 0000000000000000000000000000000000000000..a14835558fe1ad95291e69bd8454185e67e80f04
GIT binary patch
literal 979
zcmXnKVm@!s#I$_@GZP~dlOV&y&+Z?WZofP;X=fbYlSeZz8t}4lYPET^edlFl<Yr|s
zs5ay_;ACSCWnmL$a(6P6Hjo5yICzBIi&7IyQi~LP6Z4WYQj1Gciwp$}_&}2EJnX@V
zIcfPtDTY!85+D&S9zo~)-29Y$1!qSEpUm9MlGGGKMFV+|95auEqobpOb81mZW?E))
zVo9n(aB5LmW^!t=ft)z6k*R^Hp@{()M2YhnSr{4_8yXp#TAEr$88{$0E;QIs#6SpS
zA{P&Ls&8pZMp2@IXI?VQ$;>=LuD%K`VG1EW!60YoD!3av8<ZIcu(4~kd7QIlVq|00
zZe(FlVoqXUv8t*_I&s9;$oFn0vsHT2f%otJIfOpz60%=lF1>i~#3_M(4~v!<KThUn
z+AGmue)Flw{MqHVrz~o`KciazRY!Np-hchKd<15`%UL)z?VsI;r{6Zr3e7pwy_7Za
zzO<H$EaT!PMpJ_(MniBA$SSi)7>G59ED+>Uwwv~m{mrBGn(v#I)?YAKvc*7_jX6}7
zk420{WL=#=jE&~BgDc$CStCC_u)Xq>>oYjOW%(Hy|Ff_#GcmG(13*?7#OE+zV`Ti#
z#K-_KLX}0#K!lA$n~jl`m7SRp&SEk!1lgd#qGh0Az`@3r-pIqq#Av|F#;wi9$imp%
zr^v{F%4JG1a0Y3SXR$G`GO$=+w!oy#D5IpLz)D{~xhO|3IUf|$$%!C_zN4cfQq004
zRxi0I$G`;U21Z5}4Ffd;6&T-uu}uPMUVd_M0mz*ElzfPRXvq^W<|al)hV|Qi8OxUX
zG$n)^zJ1~Nb47AkmBy+Cr(S;WtDk(@uJ8BC<B?xJS4BQ8-W+V~e85%iVjk0jAhv+w
zfQJPiR=hDevCiz+%57yIx|&XE-1I&?)mAZcYOas^G(+ZjPv)OIr`A(DM<?a_&AZDw
zUKYQNFv~sI&yaEbQ|5z}c{g`T9$bFn>XJt$y-RmzE?%5mTiwqQyzJhV$Lc+ww*0%i
zsc(@{F8Aed36Yn<vzp&Oo?Gdj_1)v=DZU$v7swy}_rvg9$9vx84^HGq)z;fhUA)(H
zGtc>ME$-->$Lnhz>AzvQn6!&?d)W7^C(k|ItlPLlICQ$L%J@&+(-(DGl9~Ih=bMwN
Iu~~U303;+#MF0Q*

literal 0
HcmV?d00001

diff --git a/src/trust-fixtures/intermediate-8.der b/src/trust-fixtures/intermediate-8.der
new file mode 100644
index 0000000000000000000000000000000000000000..3e4312b3ef824470da901205e6a4065ed9153ce1
GIT binary patch
literal 876
zcmXnKV$LvVVtTiLnTe5!iC;5Q?U4H7g+a-aHcn|;%3{F9#-Y{ban6>7nb{!BklTQh
zjX9KsO_<5k&rsDs8N}h@kxBI}P01)qR0v5;&dAHp$xqKrEmrW!%*`xGO)*q3kOL`W
z<`GZL4bDu@QwYk>FHs2b3081+RM1s$H#U$H=QT1lFfleTG&MFiF^m%DH8C(SF|shU
zFg7qSh%#_MvNtr?P{cq8WFQw0H_TqoyktXZ14)o5Gmns~uY!LVvIWitWd;Il>|lQ|
zF|x60H?lA&F()yw2sZ_u4O%m4#=#S-Zk8L#zMlS^b1%2gf;CHHPpl2R^JlJT=fcQ3
zt3ZW^@2?pivy(7Ab?VWK%w>9FhA$R1Hm(j!%smo2v1<?K=hb}4=PR|A+<9BvzR!I3
z(#(+gGEAEa-li{ZVw`5s#5l=7o{c$FR+&Y@K&(OJq19@|nvaitL)Kj>+WxmY(n(=L
zh=D9f0UwJPi-^gqS3Ivza^3oQ;pn5cvnx)v&y&u9NUO4l8HliPXtOc0va&NX!dXlP
zu^`<FEMW#A29|8x+H8z0jLm(Dj0}thS_T?0bxe$6G8rW$1y=g{MX3e(#hE4fMU{G~
zxy703d3wqDxdyyQTAA_;IM~?I8+jO+m<&o`Mldq6WE!L!sKEFJjBOH7BlDAs3v`o_
zjkAZVVrnynssaqF#rnyqMJ2`huD<?ZAwI#*j_$_JdIjdm2Ie4N$+H+3=o#oN&|09;
zrUo@7xhMz8B7OU!{QQ!VoZ{rfbYs2bq8tN0kVbw+#{VoV%uI}I;N&7J4B~SburV_J
zXJTYPPS?yC3<jx8h73n$ZqLcFeZ9=}`XoaYbIv^{QlHqb-q_5Ueor{~)vt^M<`sg*
zeKMwj<wxdk*esOto5?_A+AW?_D*OkPUOx8g;5Q05reAMjG>>z2>lB`n4_#N)H>{QW
S`)JGTZy#43opWz0cOn3C;0J2}

literal 0
HcmV?d00001

diff --git a/src/trust-fixtures/intermediate-9.der b/src/trust-fixtures/intermediate-9.der
new file mode 100644
index 0000000000000000000000000000000000000000..8aecb89764df6901169db5aa07e4d46727ffd836
GIT binary patch
literal 979
zcmXnKVm@!s#I$_@GZP~dlORKHl!xHtd0*VG7Yd%e*)r>;0WTY;R+~rLcV0$DZdL|^
zYC~=VPB!LH7B*ofcPB$>14$5vgGb1{C^fMpwMfA?F)ukIwYVg;$WXw54<yOX!ycTN
zla^nUVkl)G0TSWj5p>Sa%}>c!aCTJi$;{0xNlh_SG>`|$G4n_`Iyx#irxulDre!84
zmZT~KrxulECZ`q~$cghBnHrcHnizmVlsK=Eg`ttLp^>qvrKx3<fdi7`LW2!O41_=?
za`AAd`j)0-6eTKn<|V_N%*-R?>Z{-%rV!#240499g1fP^L79O78@pDU$2nUjMmARM
zMivGo<|GCd;ikZ|L2D+>ICx^!&2l5z*VCVK?&bDbux4rOiM4@u{>&BaTo_qr6{zs=
z{WZg5b`qwiPCc5DxlB*Y@WrCW#?@hoxkq9rcJ1N(yqYihe5KZsJ8z5I_nGfrni(=*
zhG|p5+w{dvjHU)njE3MKkX2@pFc51HSs=)zY&Y#A`<qAWHQzTat-oNfWQ&0;8*`{E
zABz}^h{>y0Jg-l3-THaq=%cr@D^9l0lg<GLxGX;-<9`+wW+p~9Z~({(gZLZ<Y>bTm
znHU)$MyRrg8HliPXtOc0va&NX!dXlPh9DahShNf@3^>@>(i?dgnV1ZC*|@dY7+Dyb
z`xF@&7*V)Pc?QlPE%Gcj237_Z3(OXnv>9cTloVL$>n9iG=q2ZaVmdhy#L#zibVQ0-
zSj6fj7v&h3z}&#d$f9AOW}pJ&8!)y>K+VffE-nC>lb@0gF%T_z0><3L$jBfU_AqV6
z!wDZ593%W?r5$+}zUtBz<<Hf04!KgPQ$Bs|gzC)!7x%r7<k`)0S4rdbZk8<nC!Qzz
zzTQ56F>&eVlMf=igzmm|o}0b0=Gy{$eb-f=_V|R^wH*$&ef*}l%Gw|&<dEE*55E~W
zH7DyDel`~B{=V|5yq~en>>0Om^KNCHdQf@lhSo2+r;b-V>>o_<T@-$A$%C3xo9A8A
zuAaEGFOl(?sM)_Q%RgHQ1t;)Nm@#+i#LOn?gd97Ln<4ILA2x_Y{rB4F^KFiH<0jwq
zVBM1@Qycnxr(FAzas0IV``53Ga_<VyOU_w%lf|rDe#R>H=pFl<T0;9A{ae;5JP%s;
JY5l8YRse^4M(+Rs

literal 0
HcmV?d00001

diff --git a/src/trust-fixtures/ov-g3b-aaa-emudhra.we-have-a-problem.com-0.der b/src/trust-fixtures/ov-g3b-aaa-emudhra.we-have-a-problem.com-0.der
new file mode 100644
index 0000000000000000000000000000000000000000..dcd713c2c4c0638676ec7bbeaeb2cf4a56661ed4
GIT binary patch
literal 579
zcmXnKVzM`AVm!8hnTe5!Nkra5tVSf=N@a23?X}(C^(Gk{V=^+}V&l+i^EhYA!pvk~
zZ^&)H$;KSY!Y0h*=VK^rAPC}c@o=U3mZoGBB`P?D8A=;Sf&`g)gj{_U{KFJNe1a96
z9TjvH+>M<K<ivT6%nS{T3=E8nj7*H8#CeU(4NMJ;4UCM;O^l)pj13J9^dZ_c^2>D7
zjgxc}6BBh)bHT>zm8a@vB$lP>Ch8Ux<tOE&=ISNq=Nd#B2(z(+-N?iUbu2R@JF^o5
zi@D&BtHST*2jwTM->MPxuQ%a$uHq$b_sczL1+sqj6C-USAO5N?o3L}{>e9wd8V}~R
z@V<<(WHEmJi>*TTfykr{iyK!PG_Ek<VPg)J6=r1o&%$KDV893B@q>7Pu`n~SHy8+m
z_^K>CppepLV`ODzXJ#}o1_=tX=on}<5$_RMkS0DBF&2?E7wqOO@DZMt?{e_yv?uy=
z-Z<61FpvjHE3-%#h&71JzL6TZ{`qqq^R*oBG9_>BH*Z<T1#$p57+9E@n9~^yQkV=_
zyw-|13Z|JU%f^0oI2QC_cWxrDeTePSe~lK26~E7kbhB3eD$r}Y|F89yLsn_yMkWK5
z*tyZCGi~lI^~+7+ef3#-O((<T%@1$A*t+Cx%fYgr&)@Bzx=m!?;q|9xdfqL*?VAAr
D4wk!{

literal 0
HcmV?d00001

diff --git a/src/trust-fixtures/ov-g3b-aaa-emudhra.we-have-a-problem.com-1.der b/src/trust-fixtures/ov-g3b-aaa-emudhra.we-have-a-problem.com-1.der
new file mode 100644
index 0000000000000000000000000000000000000000..b3da3b9bd2d6eb2955f9ec195597895d5467b2a9
GIT binary patch
literal 978
zcmXnKVm@ck#I$VzGZP~dlOV%OC*{2_^(Xp8?Oe0^?;3Lf170>xtu~Lg@4SqR+^h@+
z)rQ;#oNUaYENsF|?oNi%29h8S2ak|@QEFmIYLS9(VqS7aYH>+wk)ePAA4rm&hdnqk
zCoR7y#ZbyX0wlu4Bj}u;o1c=e;Owa2lbM@YlA2<uXdn-gW9E@?baYg3PAw|QOv_A8
zEJ;-ePAw|SOinE}kQ3)MGBq$YG%)~!C~;mR3qvDgLnC8TOH<1z1A8RL`S}<M8wi3-
z<l^B<^({@wC`wdt3WK?rnMcUgSHV9_A;c#b<O*E{cVj1mG6MlNcC9v#bGA&3Y^>Ui
zEDTD_NenE-omC57+x$J%E##p8>%;0J4;8i7_r5FdI{8jFcZdBN4W2mG<gVw7)?Ak{
z(&{slxwrG%9A~DTcYBL3p2=CY=?vF9KgFDvm3ITXyuNHxdz#^MH?_h1El;bT&p~~k
zA1S%Ki<=lt4VoAY!66{4%pzeR)*!M#kW1Na+DG;`kJf9xZ(3S^!C=W216elaP+2|}
zF&2^8H&O%FKYy-czLw)%rsU22<}K^Ez~L>+&&c?ng@u`kk<CB|q+A%p=P+PnWc<&>
z$N(`yl|{@zgpEU+jggg=otY8NVlprUX;EO&GSD#KU}H;f<Y8oDGT>$7)@Ea5VQlVG
zWMp7O;WFhJID@pvv)C9|8CWbZTVT>=lu=SrV5P60T$H1ioDYiV<U|ld-_g+#DPm#q
zs+U}pV_*Vv10y4ghJl)a3XE^S*d_rrFF(1s0Ax;nN<PFuwA2Y0a}y&Y1GiiAq<uaY
zvtRo@mALmc&#kk(e$|ON<(I3ZDoQ*Pc89CB|EQUxv_M@%St8x?G3Uc|n>t$)3N3Cb
zUR!_8lc(*$dA&_{FYoBS`S-9x;d`y?5n_kWgzO1pF#q9Z!NvD!)-9&H!sk?@qhgD1
z{$4Ns*-zohiGTM#Op>!*YVtLqsF&}o5}*2~p5~BRgAFMiYi{SbI7m*s*W1g^CMNrS
z5r^sIn)AyJnyx4dyclup@S+WSmfNzbEQ(v;vU}O(JbQ7|R1SsvbG_HB^ZGY~{XEl$
z|DpS(+a_4|cE>GyYIiG1)=T2&l%4s^Y?*EKo0jIx+10!8l7HINJKxF{+0GMKl>Fqf
H!sCemV@5)!

literal 0
HcmV?d00001

diff --git a/src/trust-fixtures/ov-g3b-emudhra.we-have-a-problem.com-0.der b/src/trust-fixtures/ov-g3b-emudhra.we-have-a-problem.com-0.der
new file mode 100644
index 0000000000000000000000000000000000000000..54bff9ecd9b1ecc6c422bd3be6b196e2ec1114b7
GIT binary patch
literal 572
zcmXnKVzMx3V%)cYnTe5!NyN6|(D$9zc~98WcU4viT=~dcv{uf5i;Y98&EuRc3p0~}
zy&<;&CmVAp3!5;LpO2xifgp&(#lw~ATbhzll&IhoW+-hS2@+)H5pwla@DEc6@d;LN
zc2v++a5r``kQ3)MGBY$VGB7YOwKO)566ZBCH!w9YHZU|WF*c7f&^OdI(1vJN$uHAQ
zH%`(`%>^5+SDvbykyw_ho2Xk*l%JH7nyZ(bpKB0lAk4-Nb{`WX)S=9b?95IKEWC*s
z_IsajMo)I-ecA2I@hhw9%lkynmbOEpOZPvVCoRnu_~pdzL=WFio!W}i91~Qla~Ga}
z$(yjZs);FjL1)a~#f{4i8kZRGurY_q3NtePXJIm6FyI66_yGg)SeTjE8w`X&d{q`6
zP$+4$F|x9<Gcy|Kg9HUxGz`?5i1UOjNCO{>7>kHVySc^YTr;`4ZPMP_vpDn;ubCMd
z$b+PnStJa^8boH_NDW;7{JD<#T8?*_k~jC8x2)p=Sq=^Y7G@^q3<iT#CPRh=^X5Lb
zIdH`H$9KhcxjkHIQ=Pa!9u#{WV>NmHSuVLxn$k0uHTvH6%F+uKiY(Y(?#N^iCzCNf
zOuV^e`n`kO7k$5OaOL<7_SyaiufI#46?f%O@kI;UGxIo`1@grgUG{hGi=77m!7#GW

literal 0
HcmV?d00001

diff --git a/src/trust-fixtures/ov-g3b-emudhra.we-have-a-problem.com-1.der b/src/trust-fixtures/ov-g3b-emudhra.we-have-a-problem.com-1.der
new file mode 100644
index 0000000000000000000000000000000000000000..ded8f517c2001ceb868112089213ab5f314f1dbd
GIT binary patch
literal 874
zcmXnKVooz?VtTuPnTe5!i9cuU;`HA#0t_8Oe2bW_W*Bg>acH%9oU>(NW;O^j<Tl`B
zV-96u6K3-CGgLKD264D}WKw-gQ!<JY6+%*zGxG9t^3yX@ixqq_b2Cd)Qw$Xh<Uq=p
zdBjt5gEQ0f6oT^eOB6zUf)$({6?7HcjSb|)d5ugBOpFZ-%?u0-jiSVPO$-c7j4TW-
zj13G7q73Yj?Dg|86gCh98OX)M1+&*F%uw1u5+umXBjoC<;2(x;zLP<jfdCsj*c(iY
zY^>UiEDTD_NenE-omC57+x$J%E##p8>%;0J4;8i7_r5FdI{8jFcZdBN4W2mG<gVw7
z)?Ak{(&{slxwrG%9A~DTcYBL3p2=CY=?vF9KgFDvm3ITXyuNHxdz#^MH?_h1El;bT
z&p~~kA1S%Ki<=my88k6YGLUCu4wY4AkuVTz5P4{|TCwKiW8aW<SBkd(?T&O(m=Izh
z3sS(xBE}*z`$lTu`sdGe%-3?f%apvi-@IiV7erc>Ma)2ijYFG_k(HI5nGw!nGKdA~
zR$vJ;2r;l^<JM+lWMORXQ)FadG|)28fT?3*6qCs)DJihh*Dp#f$S=+;$uFwZOU*6L
zOwZFx&d)XAMbgTYXTZV6mfpz2$i!q&3NwO{ktNe0-9QD#H(+d&fEt;fTwI`=glwEW
zToqHBF<?+tSS{91PAw`a)_3*w4-4@Lc6M|(cG4>_Pc|?I`AVL}z(CJHXMxrNjW#u?
zDal1SNEYea7v<-dl;jjAC#D<gB^Tuw@PRb)Gcx{XVPR%sWHS%~@r6Nr4g)qu#{W!=
z49LlvIi0~Eg~`BS@;k?FbI-Po%=g)TizhC7yS3xBd#dSO>t_{;{wc5Bo5M6`d!`<{
zbNfu8V*go-OH2lF%WQ8eFFLkr)<>SGMRVBX^fz>0_gHzMf0oU;jgF6+CjDG4)7x_I
PgU$C`j$6C_?A;9jIavo;

literal 0
HcmV?d00001

diff --git a/src/trust-fixtures/ov-g3b-emudhra.we-have-a-problem.com-2.der b/src/trust-fixtures/ov-g3b-emudhra.we-have-a-problem.com-2.der
new file mode 100644
index 0000000000000000000000000000000000000000..76baf7160f57e167399b56a31de806559275cf44
GIT binary patch
literal 888
zcmXnKVlFXgV*0s&nTe5!Nq}LRl-+OP$nd-i4y;=;yrK=b*f_M>JkHs&Ff$uu8*&?P
zvN4CUun9AH`WXrv2!c4=!d$7j!I|lK3IX1phN=e2AVDr+nN;7>l#HT8g^<+bjJ*7u
z{PfJ!Vg;Yf+{}{H6hj3AIgm1DVR5KlS7&F1p#1z21!qSET?Kbz137VCBNGF2LqkJT
z6JukuC~;n6O9OKQOG67|0|SF7gD_Ob!0hEA&R!mvy<j^-e1hTjmKg}Jv4g$L#K^{~
z-N?eA#GJ&y63>6fes#Fmk$ufyH?zqvnDFTR0>-#D^V@dzEQVhsD_ZoobovWe`Kv{|
zzj(03=(@upZ;?NHl{mQqPc46-@o14(Y5UZRI+AZT3!KyGt``!q>}y+RwtpjIfzC4d
z5AMz}Jd2wcOAVSB3k~Gim_uciStJa^8boShnOcOeoavg~curhKPg8D=N3xTFEJy(#
zix`W@L#x$_H6I`QhOE0%wEb^)q?5vg5QwxYi<p538;3R<BP%OAGb5bEWMB)@t-xYt
zU}9jz#u6&4z+j+dpaE0B#3&|{QBqQ1rLSL<T999yS(0B=sh65toSB}dmz<w#PytiP
z$jFjokY%6*;~Oxxi9vPdCl?nW>v4grVQRC0ssRkE>H5j3MJ2`hkQCwS><o$<XGeEq
zz2u@217ncG<ymw<&Rw9kK&4FyYE*Jj4w7y5NSbmC_&}QY85#exurM<*vKa`0_`)DQ
zhXETS<9{YbM&uOEoXKF2#$?E_{X)l5!Ih7fusb$fVJkXy`1N~j|A*gxE}G(?;I~U;
z`nTosJ!NYPUv+3Z`iMW!FkirA$nY`C?aG#$B~08GLT0QMz31XK&sWD~;b)U;M(+0v
Z*K-!^{<76J;8WS+k}E%*ly5PM0s!Vt1#<uZ

literal 0
HcmV?d00001

diff --git a/src/trust-fixtures/ov-g3c-aaa-emudhra.we-have-a-problem.com-0.der b/src/trust-fixtures/ov-g3c-aaa-emudhra.we-have-a-problem.com-0.der
new file mode 100644
index 0000000000000000000000000000000000000000..1e706a3c0c2c8a5b514b2f0676883d973c2e8066
GIT binary patch
literal 581
zcmXnKVsbQSVm!WpnTe5!Nks4I^2od;qHz<_rOKwA*S>z(skhRAi;Y98&EuRc3p0~}
zgCVy8CmVAp3!5-gXt1G(fe?tp#lxNITbhzll&IjDmux6)APEv><`HuBRqzi}2=NJ4
zaCTJCRd6?UHjoqNH8L|aFfuSOGBPqTiW28FGB+?aFg7qUGB+`bGB7qYG|-1=*T^r^
zO*c-~O-xMGP0a<HuUDR`n~_+Ss+*`=P?VpPlbWlSoS$nDX&}tT4t69HBh<CbjO@%#
z3@rKkcQ&W7oA$8Ze8S?kEygc3ul`Hgerq;~BOBt<QmR)!zdu#?NioY?=f2=#z0(hZ
z>dap*UjA5rQs3s{*z@b|S}bl{ZP2*FfQOAaR92Xg@jnZb0fPY_h{q4&0mj12#NJ>a
z4C1S@@PL9!n~jl`m7ST<z!)Sb$f9GQ)kM5UWI>wvSj1RFtQW|<x@Q%<>*w2?PGiH^
zGP|?qE*i*#q?K7D48$5lOkTa>d3}=W*3Sz^AHAJjak71$bPmV?;9y{3W@64@Fi2%G
zWcb^6Aidelu<h)V=e1h}r2;=Dr>x@ZJ#$}S@nen4%3E@ROZJBaRv++hVQ%tH|I-x9
zWFT!R@`SPAXB&r+^rGF%of*$px~5F~HvQA{(wW)YE`_md{^O8!=W$1N>TEBiwX#<)
F0suTazW)FK

literal 0
HcmV?d00001

diff --git a/src/trust-fixtures/ov-g3c-aaa-emudhra.we-have-a-problem.com-1.der b/src/trust-fixtures/ov-g3c-aaa-emudhra.we-have-a-problem.com-1.der
new file mode 100644
index 0000000000000000000000000000000000000000..8aecb89764df6901169db5aa07e4d46727ffd836
GIT binary patch
literal 979
zcmXnKVm@!s#I$_@GZP~dlORKHl!xHtd0*VG7Yd%e*)r>;0WTY;R+~rLcV0$DZdL|^
zYC~=VPB!LH7B*ofcPB$>14$5vgGb1{C^fMpwMfA?F)ukIwYVg;$WXw54<yOX!ycTN
zla^nUVkl)G0TSWj5p>Sa%}>c!aCTJi$;{0xNlh_SG>`|$G4n_`Iyx#irxulDre!84
zmZT~KrxulECZ`q~$cghBnHrcHnizmVlsK=Eg`ttLp^>qvrKx3<fdi7`LW2!O41_=?
za`AAd`j)0-6eTKn<|V_N%*-R?>Z{-%rV!#240499g1fP^L79O78@pDU$2nUjMmARM
zMivGo<|GCd;ikZ|L2D+>ICx^!&2l5z*VCVK?&bDbux4rOiM4@u{>&BaTo_qr6{zs=
z{WZg5b`qwiPCc5DxlB*Y@WrCW#?@hoxkq9rcJ1N(yqYihe5KZsJ8z5I_nGfrni(=*
zhG|p5+w{dvjHU)njE3MKkX2@pFc51HSs=)zY&Y#A`<qAWHQzTat-oNfWQ&0;8*`{E
zABz}^h{>y0Jg-l3-THaq=%cr@D^9l0lg<GLxGX;-<9`+wW+p~9Z~({(gZLZ<Y>bTm
znHU)$MyRrg8HliPXtOc0va&NX!dXlPh9DahShNf@3^>@>(i?dgnV1ZC*|@dY7+Dyb
z`xF@&7*V)Pc?QlPE%Gcj237_Z3(OXnv>9cTloVL$>n9iG=q2ZaVmdhy#L#zibVQ0-
zSj6fj7v&h3z}&#d$f9AOW}pJ&8!)y>K+VffE-nC>lb@0gF%T_z0><3L$jBfU_AqV6
z!wDZ593%W?r5$+}zUtBz<<Hf04!KgPQ$Bs|gzC)!7x%r7<k`)0S4rdbZk8<nC!Qzz
zzTQ56F>&eVlMf=igzmm|o}0b0=Gy{$eb-f=_V|R^wH*$&ef*}l%Gw|&<dEE*55E~W
zH7DyDel`~B{=V|5yq~en>>0Om^KNCHdQf@lhSo2+r;b-V>>o_<T@-$A$%C3xo9A8A
zuAaEGFOl(?sM)_Q%RgHQ1t;)Nm@#+i#LOn?gd97Ln<4ILA2x_Y{rB4F^KFiH<0jwq
zVBM1@Qycnxr(FAzas0IV``53Ga_<VyOU_w%lf|rDe#R>H=pFl<T0;9A{ae;5JP%s;
JY5l8YRse^4M(+Rs

literal 0
HcmV?d00001

diff --git a/src/trust-fixtures/ov-g3c-emudhra.we-have-a-problem.com-0.der b/src/trust-fixtures/ov-g3c-emudhra.we-have-a-problem.com-0.der
new file mode 100644
index 0000000000000000000000000000000000000000..850e59416bd1153cf74eba9270e647b64edc9f2e
GIT binary patch
literal 573
zcmXnKVzM-7V%)!gnTe5!NhJ1A#n13wfrid6(+)D+_Bi?Z?+Y&jE;bIWHji_*EX+&>
z4u;$YoNUaYENsF|p}~eC20|bX7Y}!;Z)r+KQKEupUb3OIfh0(jnMcUgSHV9_A;c$G
z!P!wkSHa!b*+5R5*T~G!z{tSBz|_*%JW8C`$lSoxz}Udhz{J=*%0S;x*FYPhT_wLv
zH{Cc{H#HY*wqALvZbo8Rs&1lgK~a8EPHL`Ra(=Esq=7ISJJ^9tj8K;{GqN)~F|eE#
z`r=;JeCOi)jD1{7ld`ycimx!uk$n}Qd8vD=^x8}39txe1IT5|&>Fb6y+Loc;I8@S1
z|LNa<Yb{^>KSs^dOn-6Xa)ZVt20U!cp|Zk^jQ?4f3>XafKs<iHKs**^CiVscVGv)H
zg$EQ&+H8!htnAE;2KpdDK^6@IwI<>`Aq&#L$0EievR>OU|5f47eKoxQ=RW)VM{3Ho
z-+v6`LDI@B5(Z)oA||h1@w`6Cb?fJaqmSOst~l8~PdW!=IXDPdn3<R}7z|RG3`}qF
z1w7hpu(i}8P{YU|E@<@=2Oga)>#I?38E#i?I`vI;(V3p*$6EJ$7zT>&O0sKaGGu6d
zYdqnJ+N@<?sx^|^_sEI2AK%WbtEZ=I5@2QgQQp@4$qN5cgZuGbnm>0*&w4JA0su}=
By3YUr

literal 0
HcmV?d00001

diff --git a/src/trust-fixtures/ov-g3c-emudhra.we-have-a-problem.com-1.der b/src/trust-fixtures/ov-g3c-emudhra.we-have-a-problem.com-1.der
new file mode 100644
index 0000000000000000000000000000000000000000..3e4312b3ef824470da901205e6a4065ed9153ce1
GIT binary patch
literal 876
zcmXnKV$LvVVtTiLnTe5!iC;5Q?U4H7g+a-aHcn|;%3{F9#-Y{ban6>7nb{!BklTQh
zjX9KsO_<5k&rsDs8N}h@kxBI}P01)qR0v5;&dAHp$xqKrEmrW!%*`xGO)*q3kOL`W
z<`GZL4bDu@QwYk>FHs2b3081+RM1s$H#U$H=QT1lFfleTG&MFiF^m%DH8C(SF|shU
zFg7qSh%#_MvNtr?P{cq8WFQw0H_TqoyktXZ14)o5Gmns~uY!LVvIWitWd;Il>|lQ|
zF|x60H?lA&F()yw2sZ_u4O%m4#=#S-Zk8L#zMlS^b1%2gf;CHHPpl2R^JlJT=fcQ3
zt3ZW^@2?pivy(7Ab?VWK%w>9FhA$R1Hm(j!%smo2v1<?K=hb}4=PR|A+<9BvzR!I3
z(#(+gGEAEa-li{ZVw`5s#5l=7o{c$FR+&Y@K&(OJq19@|nvaitL)Kj>+WxmY(n(=L
zh=D9f0UwJPi-^gqS3Ivza^3oQ;pn5cvnx)v&y&u9NUO4l8HliPXtOc0va&NX!dXlP
zu^`<FEMW#A29|8x+H8z0jLm(Dj0}thS_T?0bxe$6G8rW$1y=g{MX3e(#hE4fMU{G~
zxy703d3wqDxdyyQTAA_;IM~?I8+jO+m<&o`Mldq6WE!L!sKEFJjBOH7BlDAs3v`o_
zjkAZVVrnynssaqF#rnyqMJ2`huD<?ZAwI#*j_$_JdIjdm2Ie4N$+H+3=o#oN&|09;
zrUo@7xhMz8B7OU!{QQ!VoZ{rfbYs2bq8tN0kVbw+#{VoV%uI}I;N&7J4B~SburV_J
zXJTYPPS?yC3<jx8h73n$ZqLcFeZ9=}`XoaYbIv^{QlHqb-q_5Ueor{~)vt^M<`sg*
zeKMwj<wxdk*esOto5?_A+AW?_D*OkPUOx8g;5Q05reAMjG>>z2>lB`n4_#N)H>{QW
S`)JGTZy#43opWz0cOn3C;0J2}

literal 0
HcmV?d00001

diff --git a/src/trust-fixtures/ov-g3c-emudhra.we-have-a-problem.com-2.der b/src/trust-fixtures/ov-g3c-emudhra.we-have-a-problem.com-2.der
new file mode 100644
index 0000000000000000000000000000000000000000..76baf7160f57e167399b56a31de806559275cf44
GIT binary patch
literal 888
zcmXnKVlFXgV*0s&nTe5!Nq}LRl-+OP$nd-i4y;=;yrK=b*f_M>JkHs&Ff$uu8*&?P
zvN4CUun9AH`WXrv2!c4=!d$7j!I|lK3IX1phN=e2AVDr+nN;7>l#HT8g^<+bjJ*7u
z{PfJ!Vg;Yf+{}{H6hj3AIgm1DVR5KlS7&F1p#1z21!qSET?Kbz137VCBNGF2LqkJT
z6JukuC~;n6O9OKQOG67|0|SF7gD_Ob!0hEA&R!mvy<j^-e1hTjmKg}Jv4g$L#K^{~
z-N?eA#GJ&y63>6fes#Fmk$ufyH?zqvnDFTR0>-#D^V@dzEQVhsD_ZoobovWe`Kv{|
zzj(03=(@upZ;?NHl{mQqPc46-@o14(Y5UZRI+AZT3!KyGt``!q>}y+RwtpjIfzC4d
z5AMz}Jd2wcOAVSB3k~Gim_uciStJa^8boShnOcOeoavg~curhKPg8D=N3xTFEJy(#
zix`W@L#x$_H6I`QhOE0%wEb^)q?5vg5QwxYi<p538;3R<BP%OAGb5bEWMB)@t-xYt
zU}9jz#u6&4z+j+dpaE0B#3&|{QBqQ1rLSL<T999yS(0B=sh65toSB}dmz<w#PytiP
z$jFjokY%6*;~Oxxi9vPdCl?nW>v4grVQRC0ssRkE>H5j3MJ2`hkQCwS><o$<XGeEq
zz2u@217ncG<ymw<&Rw9kK&4FyYE*Jj4w7y5NSbmC_&}QY85#exurM<*vKa`0_`)DQ
zhXETS<9{YbM&uOEoXKF2#$?E_{X)l5!Ih7fusb$fVJkXy`1N~j|A*gxE}G(?;I~U;
z`nTosJ!NYPUv+3Z`iMW!FkirA$nY`C?aG#$B~08GLT0QMz31XK&sWD~;b)U;M(+0v
Z*K-!^{<76J;8WS+k}E%*ly5PM0s!Vt1#<uZ

literal 0
HcmV?d00001

diff --git a/src/trust-fixtures/root-0.der b/src/trust-fixtures/root-0.der
new file mode 100644
index 0000000000000000000000000000000000000000..8ab64eb3ad0e2b656cca8b578987f210e9aa1e98
GIT binary patch
literal 557
zcmXnKV$w8dVqCv~nTe5!Nr116t>~k(>--b{xHjxzeLTg0i;Y98&EuRc3p2Apm?5_T
zCmVAp3!5;Lr=Ov!fij50#UqpITbhzll&BDrnw*iBpOc@SnOdyilbM@YlA2<uU?2xl
z#>^w0nj4&%o~IC$pI@R7;uEak?5Lot;BIUnC(dhRVqj!oVPIisX>1fF&TC?6U}Rtp
z<<iXFG6MlNcChc57};308(A2Xn3EV-;`#5`uMQVGvak8;W;Xc+6CS-^z!(QuoB3@!
zdlthlk`*obTRQy(to+p?-d{XeVszc%khjR6y-J*1fv1)~(0H`StF(RUMIFgEn+4A4
zbk_@sSoXE8GuywBu|Q{;{0DdE7@oyW1`Y<YY|Npud@N!tA`h)rE7p8`>>IM~O40Ve
z-H}cT6G9C5K+^n-jQ?3!n3)*a4ERBOVGy6yfSHl;KXSY<XD}F~G8rUtgglw9cVqhg
zHIF1V{PLTrYI^wwN5{IKYi9oHUq8{h@{D-?N^#~%mqqWb?q_)yUd?34u=nt?pxmgf
vv%dFOFZU9+=sTkstfBJFCFIx1>a15a4_q1+uw_ionIOI?t>y%e^2u}noZ+-=

literal 0
HcmV?d00001

diff --git a/src/trust-fixtures/root-1.der b/src/trust-fixtures/root-1.der
new file mode 100644
index 0000000000000000000000000000000000000000..a031adf4bf37081669d3f755a1a318cf6ba8e8ce
GIT binary patch
literal 556
zcmXnKV$v{ZVqCj`nTe5!Nr18c+)4F=VqfRXth>W=R!`f2i;Y98&EuRc3p2Aps3Erj
zCmVAp3!5;Lr=Ov!fij50#UqpITbhzll&BDrnw*iBpOc@SnOdyilbM@YlA2;DZy*a&
z#>^v@nj4&%o~IC$pI@Tj9IW8%sGzIhZfqbY&TC|1U}RunU}0=*Xc8sPYhr0&WMB^E
z(#qO00|7R6u-}*%*;ut3Ss0X<lNeaM;!}(#d<o${*Sv4;`Kg}|N2E*g$$J7OU;DlO
z6`QBNa=&IQtC!`Sb}j}<KMAoa6C10Eft^M|ebZ*o?~Zo~p0V4)VX6G}BWX{Xul~Dv
zP&Z#gQT)Q(1@WcPxl{kjwuHVjT<m1v01gpZJ{B<+k&F`NAFZc)LjuBO#U7lv=gPbK
ztgZnc8*`{EKO^IR78YhEMm7U}5MLO?XEk7EWc-gDE6kY;25C%&4D0=-Fsv49FArj!
zadpK$p7<Pzh^SV-+I9bw)m2NbvTc;AWf$63(`5K$9@o5I*I5@a88Upi8|~pZYvbZ}
tfv~dwX(`u3#gr<hZ7a``el+XQLtn0R9tkCh)xWI%x*q?~@>=5r69Du{tm^;(

literal 0
HcmV?d00001

diff --git a/src/trust-fixtures/root-2.der b/src/trust-fixtures/root-2.der
new file mode 100644
index 0000000000000000000000000000000000000000..5c715faed85eae3569262d7f3dd3fa93a62dff60
GIT binary patch
literal 1078
zcmXnKVlgskVwPIK%*4pV#K>sC%f_kI=F#?@mywZ`mBFCeklTQhjX9KsO_<5u$xzxr
z62#%)5ppj|O)N<*Qt(a8OU_6wE=esi6foceNwV{>2PfvF<rk$GN*PFiM7Veao%3_^
zQ}Pv@9Tj{sb2Cd)Qw$Xi<Uw-GJQ9wMjtb7HMJ1VOnaPPIsS3fVMP-@Esl^6z;=BeX
z28ITP24D~+&TC|0Xk=_?WNd0_Y8f@Kj%#96LJllORtDxKMt%l^CPpr%CPqeveGYTK
z<UM><)-L1g>e9E*?L;%%+=E*GB;@;^F#Y<xIyRt7%#eE)+l8YAN@qQFLz2&I%gb=%
z4t{moN9DktBEMH3Mb~`^nI*(^xN4Je!lPTAp`Vo^KHs}@{(W=XqMj-K^D{opnBdl;
ze!Oh|<1?l@-Er(GsZ9qwHmsQVGjV>ILcofN$J4gHu1I1I`_LsN{K{~#+=7{ZExvtI
zH;Tw-|C+tyw}|%o?W@jQOO7w@xy3qjg~f`~;uU6rYhKR#QeoA5p8uxPqZvG__2=_3
z-g`fPrsqf9`)f*krDtq)Kl)Vj;?D^Z$CKvlYd)@4ZP%rG{J`D0&rCA}6z2BdxOeGr
z%N*Xg7y2iem>C%u7dIX-XxwWc%f=ik%f}+dBC<e`OWAJPNA@?5)@#0RT3Ua>V96G6
zvXSLyWc<&<!py|TX21_pE)3$c8Za|5{x_%w3COdQ7!(;;EHGPO(q@!VQc_^0ub*6$
zqnDfyN?OT@Acnr9qa#vMf~6$A<f0q{vjrv#jM@w^bn4}$mf+Kenj-*X2E{E$*dL}3
zvtRsQ^6OglF_(sO{zr~}V~9AjY}+0Y&kUBb7th|szG31|xYipW;jiY$`1sj|rSJCd
zDG71h|M!p3j^qAOUpf<5>l3!KdVT)(@zDMwJ4@QO>DFeSx%AoXuKuwHS%(jsFzeJ#
zyBl?gZ#mb@gRI@FdGtTWSe?%?59MsX7wnJ|@&3=Y)v0+b-=y!@JctrKHt*)gNDl+W
zROXyFFBOa5%w}Hrz<lijQHlOvyO_=`*I6kbtaIflhuUhT=?On3#FboGG%I-Tr<EBG
z7Udnfp0jZ=|GfRLGoFWiTKDO(wuKdE<JRof>-%)y+DmQUl>F#xl1|f=EC$DbkCx5z
Lr@l0sHX{!Jzo?y~

literal 0
HcmV?d00001

diff --git a/src/trust-fixtures/root-3.der b/src/trust-fixtures/root-3.der
new file mode 100644
index 0000000000000000000000000000000000000000..235e1868581921cf51a8c6a0ef2eb6b70e80804b
GIT binary patch
literal 594
zcmXnKV)8R+V!XV7nTe5!iOc32`^t<0zFXZb23%|$T5TTZY+0C@4YCcn4LI4DLs{5_
znLParg$)Ej9ByH*)ZF0A^gM+CZ%;#217(mPm#|E#Z)r+KQKCXfYH~(ieolURW@@p5
zPiAgrNotCrf`J@J8MClBRIjVEvqDgQeu;v!qk^u2yRm_sIIp3Ffsvtwp@p%5fkBiw
zuZb}dm%ffEGZ0{72ZsX_BO9xBBMXBPa}ooK@=~51x<X$yK5yJ~_Ysp&!#vA)Pv7}~
zom4f6EP1n=P3HN5qV+G<=|6M~X%|`HwdqAo)3fNTt#>w;p6h12(5AfK?P?#tJ<FHt
zGL!1QEloc3HNH>Jf1!jVleQ68Q%bGa<co`)3>*w(*_cCR`B=nQL~3H0T7<8h>6+bm
zPFzM$Q*Mq&vXcQHNSdFK@jnX-GZQ150Y8W@4C1pIFf%g#M~*?}Oa_BACPRjOpA*kB
z3CN~QW#1u@*U`$V-^?LC;go!r&kJ7Zs*P)}HgdYZw_d}+QWG<C<6C$3OH76gb9aUQ
zS?TrS?b~N%j84@jek9!N4eSoJ{@qjkI+gSAk7;M!S2TSR3oTcv6B3xpqO%wP1+2Gg

literal 0
HcmV?d00001

diff --git a/src/trust.zig b/src/trust.zig
new file mode 100644
index 0000000..3ad45c5
--- /dev/null
+++ b/src/trust.zig
@@ -0,0 +1,46 @@
+const std = @import("std");
+const Certificate = std.crypto.Certificate;
+
+pub fn distrust(bundle: *Certificate.Bundle) void {
+    var iterator = bundle.map.iterator();
+    while (iterator.next()) |entry| {
+        const cert: Certificate = .{ .buffer = bundle.bytes.items, .index = entry.value_ptr.* };
+        const parsed = cert.parse() catch unreachable;
+        const start = parsed.subject_slice.end;
+        const spki = Certificate.der.Element.parse(cert.buffer, start) catch unreachable;
+        var digest: [32]u8 = undefined;
+        std.crypto.hash.sha2.Sha256.hash(cert.buffer[start..spki.slice.end], &digest, .{});
+        for (blocked_keys) |blocked| {
+            if (std.mem.eql(u8, &digest, &blocked)) {
+                bundle.map.removeByPtr(entry.key_ptr);
+                break;
+            }
+        }
+    }
+}
+
+const blocked_keys = [_][32]u8{
+    hex("C619E4780ED8E0ABEDA24AD732567DE4383A7EA941338F6D1A7D1B49AC792FE9"),
+    hex("0A6C2B2CA5B364207954171987AC9D2178561569D8205457E77CA90C32EDE282"),
+    hex("BD153ED7B0434F6886B17BCE8BBE84ED340C7132D702A8F4FA318F756ECBD6F3"),
+    hex("8D417DB2DD8BF5E3084D1E3F196D583849D81BDD4C00C70B9D39369E96B8C782"),
+    hex("EBED6475C2C2D80FCB199F3FE8DD6E6B3CE60B77EB15D4E42C3DEC0C6F5B5105"),
+    hex("43BFFA19D6EF651451F6841E019931E96F6F2EAEFF28AB4B6F1CE4576DE2717B"),
+    hex("E0254C7FCDC265E2F0F8A428DABB75AB4AE039B4872D62F5EE57F0877D5A8A41"),
+    hex("49DD353DC2B919A3770645117D0E60C16115E7D1BC259EEFE734B00EA434FE5F"),
+    hex("63ECEFEE431D49523BC1136C4E72D0206A477086CAF606CD5CF025686C109CF8"),
+    hex("5C0660A2B164910D8FF589C18E14552E9E0EC237DCEFE2CB736D41A4811F81A0"),
+    hex("EC4FFA1AD0AC88081314B7AAFFEF6A91F97CD57291BB5BA686C5415F5EB4F6B6"),
+    hex("92C063D67E8F14DB71D288E11266FFDAF69CBF115F7BAB14F3BC2F68D25E0E30"),
+};
+
+test {
+    _ = @import("trust_test.zig");
+}
+
+fn hex(comptime value: []const u8) [32]u8 {
+    @setEvalBranchQuota(10000);
+    var bytes: [32]u8 = undefined;
+    _ = std.fmt.hexToBytes(&bytes, value) catch unreachable;
+    return bytes;
+}
diff --git a/src/trust_test.zig b/src/trust_test.zig
new file mode 100644
index 0000000..971a4e4
--- /dev/null
+++ b/src/trust_test.zig
@@ -0,0 +1,84 @@
+const std = @import("std");
+const Certificate = std.crypto.Certificate;
+const distrust = @import("trust.zig").distrust;
+const now = 1792713600;
+
+fn add(bundle: *Certificate.Bundle, bytes: []const u8) !void {
+    const start: u32 = @intCast(bundle.bytes.items.len);
+    try bundle.bytes.appendSlice(std.testing.allocator, bytes);
+    try bundle.parseCert(std.testing.allocator, start, now);
+}
+
+fn parsed(bytes: []const u8) !Certificate.Parsed {
+    return (Certificate{ .buffer = bytes, .index = 0 }).parse();
+}
+
+test "distrust every compromised key and affected root, preserving unrelated trust" {
+    for (blocked) |bytes| {
+        var bundle: Certificate.Bundle = .empty;
+        defer bundle.deinit(std.testing.allocator);
+        try add(&bundle, bytes);
+        try add(&bundle, control);
+        try std.testing.expectEqual(2, bundle.map.count());
+        distrust(&bundle);
+        try std.testing.expectEqual(1, bundle.map.count());
+        try std.testing.expect(bundle.find((try parsed(bytes)).subject()) == null);
+        try std.testing.expect(bundle.find((try parsed(control)).subject()) != null);
+        try bundle.verify(try parsed(control), now);
+    }
+}
+
+test "genuine incident chains validate before distrust and fail afterwards" {
+    for (chains) |chain| {
+        var bundle: Certificate.Bundle = .empty;
+        defer bundle.deinit(std.testing.allocator);
+        for (roots) |bytes| try add(&bundle, bytes);
+        for (chain[0 .. chain.len - 1], chain[1..]) |child, issuer| {
+            try (try parsed(child)).verify(try parsed(issuer), now);
+        }
+        const last = try parsed(chain[chain.len - 1]);
+        try bundle.verify(last, now);
+        distrust(&bundle);
+        try std.testing.expectError(error.CertificateIssuerNotFound, bundle.verify(last, now));
+    }
+}
+
+const control = @embedFile("trust-fixtures/control.der");
+const roots = [_][]const u8{
+    @embedFile("trust-fixtures/root-0.der"),
+    @embedFile("trust-fixtures/root-1.der"),
+    @embedFile("trust-fixtures/root-2.der"),
+    @embedFile("trust-fixtures/root-3.der"),
+};
+const blocked = roots ++ [_][]const u8{
+    @embedFile("trust-fixtures/intermediate-0.der"),
+    @embedFile("trust-fixtures/intermediate-1.der"),
+    @embedFile("trust-fixtures/intermediate-2.der"),
+    @embedFile("trust-fixtures/intermediate-3.der"),
+    @embedFile("trust-fixtures/intermediate-4.der"),
+    @embedFile("trust-fixtures/intermediate-5.der"),
+    @embedFile("trust-fixtures/intermediate-6.der"),
+    @embedFile("trust-fixtures/intermediate-7.der"),
+    @embedFile("trust-fixtures/intermediate-8.der"),
+    @embedFile("trust-fixtures/intermediate-9.der"),
+    @embedFile("trust-fixtures/intermediate-10.der"),
+    @embedFile("trust-fixtures/intermediate-11.der"),
+    @embedFile("trust-fixtures/intermediate-12.der"),
+    @embedFile("trust-fixtures/intermediate-13.der"),
+    @embedFile("trust-fixtures/intermediate-14.der"),
+    @embedFile("trust-fixtures/intermediate-15.der"),
+};
+const chains = [_][]const []const u8{
+    &.{ @embedFile("trust-fixtures/dv-g3b-aaa-emudhra.we-have-a-problem.com-0.der"), @embedFile("trust-fixtures/dv-g3b-aaa-emudhra.we-have-a-problem.com-1.der") },
+    &.{ @embedFile("trust-fixtures/dv-g3b-emudhra.we-have-a-problem.com-0.der"), @embedFile("trust-fixtures/dv-g3b-emudhra.we-have-a-problem.com-1.der"), @embedFile("trust-fixtures/dv-g3b-emudhra.we-have-a-problem.com-2.der") },
+    &.{ @embedFile("trust-fixtures/dv-g3c-aaa-emudhra.we-have-a-problem.com-0.der"), @embedFile("trust-fixtures/dv-g3c-aaa-emudhra.we-have-a-problem.com-1.der") },
+    &.{ @embedFile("trust-fixtures/dv-g3c-emudhra.we-have-a-problem.com-0.der"), @embedFile("trust-fixtures/dv-g3c-emudhra.we-have-a-problem.com-1.der"), @embedFile("trust-fixtures/dv-g3c-emudhra.we-have-a-problem.com-2.der") },
+    &.{ @embedFile("trust-fixtures/ev-g3b-aaa-emudhra.we-have-a-problem.com-0.der"), @embedFile("trust-fixtures/ev-g3b-aaa-emudhra.we-have-a-problem.com-1.der") },
+    &.{ @embedFile("trust-fixtures/ev-g3b-emudhra.we-have-a-problem.com-0.der"), @embedFile("trust-fixtures/ev-g3b-emudhra.we-have-a-problem.com-1.der"), @embedFile("trust-fixtures/ev-g3b-emudhra.we-have-a-problem.com-2.der") },
+    &.{ @embedFile("trust-fixtures/ev-g3c-aaa-emudhra.we-have-a-problem.com-0.der"), @embedFile("trust-fixtures/ev-g3c-aaa-emudhra.we-have-a-problem.com-1.der") },
+    &.{ @embedFile("trust-fixtures/ev-g3c-emudhra.we-have-a-problem.com-0.der"), @embedFile("trust-fixtures/ev-g3c-emudhra.we-have-a-problem.com-1.der"), @embedFile("trust-fixtures/ev-g3c-emudhra.we-have-a-problem.com-2.der") },
+    &.{ @embedFile("trust-fixtures/ov-g3b-aaa-emudhra.we-have-a-problem.com-0.der"), @embedFile("trust-fixtures/ov-g3b-aaa-emudhra.we-have-a-problem.com-1.der") },
+    &.{ @embedFile("trust-fixtures/ov-g3b-emudhra.we-have-a-problem.com-0.der"), @embedFile("trust-fixtures/ov-g3b-emudhra.we-have-a-problem.com-1.der"), @embedFile("trust-fixtures/ov-g3b-emudhra.we-have-a-problem.com-2.der") },
+    &.{ @embedFile("trust-fixtures/ov-g3c-aaa-emudhra.we-have-a-problem.com-0.der"), @embedFile("trust-fixtures/ov-g3c-aaa-emudhra.we-have-a-problem.com-1.der") },
+    &.{ @embedFile("trust-fixtures/ov-g3c-emudhra.we-have-a-problem.com-0.der"), @embedFile("trust-fixtures/ov-g3c-emudhra.we-have-a-problem.com-1.der"), @embedFile("trust-fixtures/ov-g3c-emudhra.we-have-a-problem.com-2.der") },
+};