> > +	if (cert_validity < 0) {
> 
> maybe 'cert_validity <= 0' ?

< 0 is the correct check. The validity is a closed interval, possibly
degenerate. While we should not encounter them here, such certs do exist:

https://github.com/openbsd/src/commit/ee1b4e5ecf2dbfac6c847dec0a39c494b070bf1e