anchor.diff:  (* ------------------------------------------------------------------------ *)
   let x509_check_key_sig_alg (sigkeyalg : Sig.alg) (x509 : X509Certificate2) =
       match x509.SignatureAlgorithm with
  -    | o when o.Value = OID_MD5WithRSAEncryption -> sigkeyalg = (SA_RSA, [MD5])
  +//    | o when o.Value = OID_MD5WithRSAEncryption -> sigkeyalg = (SA_RSA, [MD5]) // Obsolete
  +    | o when o.Value = OID_SHAWithRSAEncryption -> sigkeyalg = (SA_RSA, [MD5;SHA]) || sigkeyalg = (SA_RSA, [SHA]) // We are not strict, to comply with TLS < 1.2
  +    | o when o.Value = OID_SHA256WithRSAEncryption -> sigkeyalg = (SA_RSA, [SHA256])
       | o when o.Value = OID_DSASignatureKey      -> sigkeyalg = (SA_DSA, [SHA])
       | _ -> false
   
  
positive.code: 
  (* ------------------------------------------------------------------------ *)
  let OID_RSAEncryption        = "1.2.840.113549.1.1.1"
  let OID_MD5WithRSAEncryption = "1.2.840.113549.1.1.4"
  let OID_DSASignatureKey      = "1.2.840.10040.4.1" (* FIX: CHECK *)
  let OID_ECDSASignatureKey    = "1.2.840.10045.4.1" (* FIX: CHECK *)
  
  
negative.code:     && x509_has_key_usage_flag false X509KeyUsageFlags.DigitalSignature x509
  
  let x509_is_for_key_encryption (x509 : X509Certificate2) =
      x509.Version >= 3
      && x509_has_key_usage_flag false X509KeyUsageFlags.KeyEncipherment x509
  
  (* ------------------------------------------------------------------------ *)
  