When validating a certificate chain, the provided chain aught to be ordered. If our own ordering fails, we should use the first certifcate of the (unordered) chain, instead of failing completely.
