anchor.diff:      {error, ?ALERT_REC(?FATAL, ?INSUFFICIENT_SECURITY, no_suitable_public_key)};
   select_sign_algo(_, _RSAKeySize, [], _, _) ->
       {error, ?ALERT_REC(?FATAL, ?INSUFFICIENT_SECURITY, no_suitable_signature_algorithm)};
  +select_sign_algo(_, _RSAKeySize, undefined, _OwnSignAlgs, _) ->
  +    {error, ?ALERT_REC(?FATAL, ?INSUFFICIENT_SECURITY, no_suitable_public_key)};
   select_sign_algo(PublicKeyAlgo, RSAKeySize, [PeerSignAlg|PeerSignAlgs], OwnSignAlgs, Curve) ->
       {_, S, _} = ssl_cipher:scheme_to_components(PeerSignAlg),
       %% RSASSA-PKCS1-v1_5 and Legacy algorithms are not defined for use in signed
  
positive.code: 
  get_signature_scheme_list(undefined) ->
      undefined;
  get_signature_scheme_list(#signature_algorithms_cert{
                          signature_scheme_list = ClientSignatureSchemes}) ->
      ClientSignatureSchemes;
  
negative.code:     Options = [{max_path_length, Depth},
                 {verify_fun, ValidationFunAndState}],
      public_key:pkix_path_validation(TrustedCert, Path, Options).
  
  supported_groups_from_extensions(Extensions) ->
      case maps:get(elliptic_curves, Extensions, undefined) of
          #supported_groups{} = Groups->
              {ok, Groups};
          %% We do not support legacy for TLS-1.2 in TLS-1.3
          #elliptic_curves{} ->
             {error, ?ALERT_REC(?FATAL, ?ILLEGAL_PARAMETER)};
          undefined ->
              {ok, undefined}
      end.
  