X.509: reject invalid BIT STRING for subjectPublicKey