Security
   * With TLS 1.3, when a server enables optional authentication of the
     client, if the client-provided certificate does not have appropriate values
     in keyUsage or extKeyUsage extensions, then the return value of
     mbedtls_ssl_get_verify_result() would incorrectly have the
     MBEDTLS_X509_BADCERT_KEY_USAGE and MBEDTLS_X509_BADCERT_EXT_KEY_USAGE bits
     clear. As a result, an attacker that had a certificate valid for uses other
     than TLS client authentication could be able to use it for TLS client
     authentication anyway. Only TLS 1.3 servers were affected, and only with
     optional authentication (required would abort the handshake with a fatal
     alert).