Compat self-signed trust with reject-only aux data