If something happens to have the right ip, but no stored certificate because it's not discovered, it was used as a data source if the addpolicy was lax. Harden the flow by skipping unverifiable parts of the chain.