Do *NOT* remove TLS Client Auth EKU!