Ensure that EXFLAG_INVALID_POLICY is checked even in leaf certs