xfrm: Treat already-verified secpath entries as optional