When validating a certificate chain, the provided chain aught to be ordered. If our
own ordering fails, we should use the first certifcate of the (unordered) chain,
instead of failing completely.