if (tlsa["certificate_usage"] == 1 and "PKIX-EE" in filters):
                if not self.dnssec:
                    continue
                retval["{}-{}".format(id_name, cert_hash)] = cert_pem