Clarify negative return from X509_verify_cert()