Be more cautious in CertificateChain::private_key_valid.