OpenSSL: better handling of $tls_{in,out}_certificate_verified under resumption