Verify returned bytes are parseable by x509.ParseCertificate instead of checking raw PEM text markers.