Try to get the only-valid-if-cert-valid cert from the dirmngr first.

This should always work because the dirmngr asked us to validate the
given certificate. This should make OCSP configuration easier because
there is less requirement to install all certificates for Dirmngr and
gpgsm.

CAUTION: This code has not yet been tested.