x509_vfy.c: Restore rejection of expired trusted (root) certificate