private function _checkKeyUsage(Certificate $cert)
    {
        $extensions = $cert->tbsCertificate()->extensions();
        if ($extensions->hasKeyUsage()) {
            $ext = $extensions->keyUsage();
            if (!$ext->isKeyCertSign()) {
                throw new PathValidationException("keyCertSign usage not set.");
            }
        }
    }