tolerate broken CMS/PKCS7 implementations using signature OID instead of digest