Default policy: validity is reported, but no reader certificate becomes trusted implicitly.
Returns valid-but-untrusted because no application trust policy is configured.