Backport: allow key agreement in SSL/TLS certificates (from HEAD)