When the user has a certificate check callback set, we still have to
check whether the stream we're using is even capable of providing a
certificate.

In the case of an unencrypted certificate, do not ask for it from the
stream, and do not call the callback.