This is weird. GPGSM seems to confuse a cert with an issuer cert.

The following two certificates have been created with openssl and the demo
snakeoil CA. Both certificates seem to be valid. But when importing the
floppy-bad.crt *before* importing the issuer certificate, all future
gpgsm_basic_cert_check() operations on certificates signed by this CA fail,
because GPGSM uses the floppy-bad.crt public key to verify the signature,
instead of the issuer public key (even if the issuer public key is imported, as
long as it is imported after floppy-bad.crt).