code: func (l *onionNotEV) Execute(c *x509.Certificate) *LintResult {
  	/*
  	 * Effective May 1, 2015, each CA SHALL revoke all unexpired Certificates with an
  	 * Internal Name using onion as the right-most label in an entry in the
  	 * subjectAltName Extension or commonName field unless such Certificate was
  	 * issued in accordance with Appendix F of the EV Guidelines.
  	 */
  	if !util.IsEV(c.PolicyIdentifiers) {
  		return &LintResult{
  			Status: Error,
  			Details: fmt.Sprintf(
  				"certificate contains one or more %s subject domains but is not an EV certificate",
  				onionTLD),
  		}
  	}
  	return &LintResult{Status: Pass}
  }
docs: // Execute returns an Error LintResult if the certificate is not an EV
  // certificate. CheckApplies has already verified the certificate contains one
  // or more `.onion` subjects and so it must be an EV certificate.