fix x509 -force_pubkey option to take effect with cert input or self-signing; improve...