The other theoretical option would be to do Context_Free(existing) for zero refcount instead of Context_Release (which is done and makes sense in a few other places), but I believe zero refcount just should not happen there, the caller should either be owning the cert (that is, having some refcount) or the cert with zero refcount may exist in memstore but it should not be accessed directly from the outside in this state.