Leaf credential material needed by later handshake verification.
The legacy name does not establish certificate trust, reference identity, or
possession of the private key. SSL.PKIX.verify/4 returns validated PKIX
material; explicit verify_none paths use the same container for bounded,
decoded untrusted credentials. Protocol CertificateVerify/ServerKeyExchange and
Finished checks must still complete before the connection succeeds.