static void nss_destroy_crl_item(void *user, void *ptr)
{
  SECItem *crl_der = (SECItem *)ptr;
  (void) user;
  SECITEM_FreeItem(crl_der, PR_TRUE);
}

When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.