Long overdue cleanup of X509 policy tree verification