anchor.diff:      (loop
         for rdn in rdns
         do
  -	 (multiple-value-bind (element-type ava) (parse-der (second rdn))
  -	   (flet ((fail ()
  -		    (error 'x509-decoding-error
  -			   :text "Invalid encoding of DirectoryName")))
  -	     (unless (eql element-type :sequence) (fail))
  -	     (let (attribute-type)
  -	       (unless (= 2 (length ava)) (fail))
  -	       (setf attribute-type (second (first ava)))
  -	       (unless (find (first (second ava))
  -			     '(:ia5-string :printable-string :telex-string
  -			       :universal-string :utf8-string :bmp-string))
  -		 (fail))
  -	       (when (and (= 4 (length attribute-type))
  -			  (equal '(2 5 4) (subseq attribute-type 0 3)))
  -		 (case (fourth attribute-type)
  -		   (6
  -		    (unless (= (length (second (second ava))) 2) (fail))
  -		    (setf (getf dn :country-name)
  -			  (second (second ava))))
  -		   (10
  -		    (unless (<= 1 (length (second (second ava))) 200) (fail))
  -		    (setf (getf dn :organization)
  -			  (second (second ava))))
  -		   (11
  -		    (unless (<= 1 (length (second (second ava))) 200) (fail))
  -		    (setf (getf dn :organizational-unit-name)
  -			  (second (second ava))))
  -		   (3
  -		    (unless (<= 1 (length (second (second ava))) 200) (fail))
  -		    (setf (getf dn :common-name)
  -			  (second (second ava))))
  -		   (7
  -		    (unless (<= 1 (length (second (second ava))) 200) (fail))
  -		    (setf (getf dn :locality-name)
  -			  (second (second ava))))
  -		   (8
  -		    (unless (<= 1 (length (second (second ava))) 200) (fail))
  -		    (setf (getf dn :state-or-province-name)
  -			  (second (second ava))))))))))
  +         (multiple-value-bind (element-type ava) (parse-der (second rdn))
  +           (flet ((fail ()
  +                    (error 'x509-decoding-error
  +                           :text "Invalid encoding of DirectoryName")))
  +             (unless (eql element-type :sequence) (fail))
  +             (let (attribute-type)
  +               (unless (= 2 (length ava)) (fail))
  +               (setf attribute-type (second (first ava)))
  +               (unless (find (first (second ava))
  +                             '(:ia5-string :printable-string :telex-string
  +                               :universal-string :utf8-string :bmp-string))
  +                 (fail))
  +               (when (and (= 4 (length attribute-type))
  +                          (equal '(2 5 4) (subseq attribute-type 0 3)))
  +                 (case (fourth attribute-type)
  +                   (6
  +                    (unless (= (length (second (second ava))) 2) (fail))
  +                    (setf (getf dn :country-name)
  +                          (second (second ava))))
  +                   (10
  +                    (unless (<= 1 (length (second (second ava))) 200) (fail))
  +                    (setf (getf dn :organization)
  +                          (second (second ava))))
  +                   (11
  +                    (unless (<= 1 (length (second (second ava))) 200) (fail))
  +                    (setf (getf dn :organizational-unit-name)
  +                          (second (second ava))))
  +                   (3
  +                    (unless (<= 1 (length (second (second ava))) 200) (fail))
  +                    (setf (getf dn :common-name)
  +                          (second (second ava))))
  +                   (7
  +                    (unless (<= 1 (length (second (second ava))) 200) (fail))
  +                    (setf (getf dn :locality-name)
  +                          (second (second ava))))
  +                   (8
  +                    (unless (<= 1 (length (second (second ava))) 200) (fail))
  +                    (setf (getf dn :state-or-province-name)
  +                          (second (second ava))))))))))
       dn))
   
   (defun parse-pka (public-key-algorithm)
     "Parse the OID in the SubjectPublicKeyInfo and the parameters"
     (let (pka algorithm params)
       (unless (and (= 2 (length public-key-algorithm))
  -		 (eql (first (first public-key-algorithm)) :oid))
  +                 (eql (first (first public-key-algorithm)) :oid))
         (error 'x509-decoding-error :text "Length or type mismatch in SubjectPublicKeyInfo AlgorithmIdentifier field"))
       (setf pka (second (first public-key-algorithm)))
       (cond
  
positive.code:       ((equal '(1 2 840 10040 4 1) pka)
         (setf algorithm :dsa)
         (unless (eql (first (second public-key-algorithm)) :sequence)
  	 (error 'x509-decoding-error :text "Dss-Params should be an ASN.1 sequence."))
         (let ((dss-params (second (second public-key-algorithm))))
  	 (unless (and (= (length dss-params) 3)
  		      (every #'(lambda (li) (eql (first li) :integer)) dss-params))
  	   (error "Invalid Dss-params"))
  	 (setf (getf params :dsa-p) (second (first dss-params)))
  	 (setf (getf params :dsa-q) (second (second dss-params)))
  	 (setf (getf params :dsa-g) (second (third dss-params)))))
        ;; DH
        ((equal '(1 2 840 113549 1 3 1) pka)
         (setf algorithm :dh)
         (unless (eql :sequence (first (second public-key-algorithm)))
  	 (error :text "DH parameters should be a sequence"))
         (let ((dh-params (second (second public-key-algorithm))))
  	 (unless (and (< 1 (length dh-params) 4)
  		      (every #'(lambda (li) (eql (first li) :integer)) dh-params))
  	   (error 'x509-decoding-error
  		  :text "Invalid DHParameter field in SubjectPublicKeyInfo"))
  	 (setf (getf params :dh-P) (second (first dh-params)))
  	 (setf (getf params :dh-G) (second (second dh-params)))
  	 (when (= (length dh-params) 3)
  	   (setf (getf params :dh-privateValueLength) (second (third dh-params))))))
        ;; ECDSA
        ((equal '(1 2 840 10045 2 1) pka)
         (setf algorithm :ecdsa)
  
negative.code:       ;; RSAPublicKey ::= SEQUENCE { modulus INTEGER, -- n publicExponent INTEGER -- e }
        (:rsa
         (let ((rsa-public-key (multiple-value-list
                                (parse-der ov :start 1))))
           (unless (eql (first rsa-public-key) :sequence)
             (error 'x509-decoding-error :text "The subjectPublicKeyInfo bit string should contain an ASN.1 sequence"))
           (setf rsa-public-key (second rsa-public-key))
           (loop for element in rsa-public-key do
             (unless (eql (first element) :integer)
               (error 'x509-decoding-error :text "Expected integers in PKI field.")))
           (setf (getf pub-key :modulus) (second (first rsa-public-key)))
           (setf (getf pub-key :public-exponent) (second (second rsa-public-key)))))
        ;; DSA
        (:dsa
         (let ((dsa-public-key (multiple-value-list
                                (parse-der ov :start 1))))
           (unless (eql (first dsa-public-key) :integer)
             (error 'x509-decoding-error :text "Expected a DSA public key; DSAPublicKey ::= INTEGER -- public key, Y"))
           (setf (getf pub-key :dsa-public-key) (second dsa-public-key))))
        ;; DH
        (:dh
         (let ((dh-public-value (multiple-value-list
                                 (parse-der ov :start 1))))
           (unless (eql (first dh-public-value) :integer)
             (error 'x509-decoding-error :text "Invalid encoding of subjectPublicKeyInfo"))
           (setf (getf pub-key :dh-Y) (second dh-public-value)))))
      pub-key))
  
  (defun parse-signature-algorithm (sig)
  