Add some checks for matching cert types, sig/hash algorithms, etc. Remove some obsolete FIXMEs and comments.