fix(metadata): handle certificate chains of any depth (#737)