Add new "valid_flags" field to CERT_PKEY structure which determines what