This was part of https://boringssl-review.googlesource.com/#/c/2710,
but that got lost because I was gumption-trapped by the number of
changes in x509/ that I didn't really want to make.

Change-Id: Iaf5bc8bcc2e3cfbb1b37aa477462ee8f824135db
Reviewed-on: https://boringssl-review.googlesource.com/5440
Reviewed-by: Adam Langley <agl@google.com>