Ensure proper icon for valid certs with invalid signing subkey

Usually, such certificates cannot be selected because they are filtered
out. But if the certificate that was used the last time has expired since
then then this certificate is pre-selected.

• GnuPG-bug-id: T6788