X.509: Handle certificates that lack an authorityKeyIdentifier field