Another check involves verifying that all untrusted certificates' extensions are consistent with their stated purposes.