code: private static boolean anchorIsTarget(TrustAnchor anchor,
                                            CertSelector sel)
      {
          X509Certificate anchorCert = anchor.getTrustedCert();
          if (anchorCert != null) {
              return sel.match(anchorCert);
          }
          return false;
      }
docs: Returns true if trust anchor certificate matches specified
  certificate constraints.