Make partial chain checking work if we only have the EE certificate in