We plan to give certificates w/ short validity for testing only.

So we must check certificate validity when verifying signatures on providers.
If not, one could just sign his provider w/ a testing certificate and
use his provider all the time.

Also, we should check BasicConstrain extension if it is marked "critical".