diff -up gnupg-2.2.16/sm/certlist.c.keyusage gnupg-2.2.16/sm/certlist.c
--- gnupg-2.2.16/sm/certlist.c.keyusage	2019-07-01 17:17:06.925254065 +0200
+++ gnupg-2.2.16/sm/certlist.c	2019-07-01 17:24:15.665759322 +0200
@@ -147,10 +147,9 @@ cert_usage_p (ksba_cert_t cert, int mode
 
   if (mode == 5)
     {
-      if (use != ~0
-          && (have_ocsp_signing
-              || (use & (KSBA_KEYUSAGE_KEY_CERT_SIGN
-                         |KSBA_KEYUSAGE_CRL_SIGN))))
+      if (have_ocsp_signing
+          || (use & (KSBA_KEYUSAGE_KEY_CERT_SIGN
+                     |KSBA_KEYUSAGE_CRL_SIGN)))
         return 0;
       if (!silent)
         log_info (_("certificate should not have "