else if (x->ex_flags & EXFLAG_KUSAGE) return 3;
else if (x->ex_flags & EXFLAG_KUSAGE) return 4;
static int ca_check(const X509 *x){	/* keyUsage if present should allow cert signing */	if(ku_reject(x, KU_KEY_CERT_SIGN)) return 0;	if(x->ex_flags & EXFLAG_BCONS) {		if(x->ex_flags & EXFLAG_CA) return 1;		/* If basicConstraints says not a CA then say so */		else return 0;	} else {		if((x->ex_flags & V1_ROOT) == V1_ROOT) return 3;		/* If key usage present it must have certSign so tolerate it */		else if (x->ex_flags & EXFLAG_KUSAGE) return 3;		else return 2;	}}