Should we decide to backport this to 1.10 or earlier, the attached patch 
should work.  (The trunk patch won't apply, since the ASN.1 encoder has 
changed significantly since 1.10.)