Factor some common code in x509_verify{,_child}