Hybrid certificates verification: how to force the verification of alternative signature when using CertPathValidator.validate() ?

[sbahloul]

Hello BouncyCastle community !

Using the version 1.79 of BouncyCastle Java libraries, I noticed on one hand that a certificate chain validation CertPathValidator.validate() does a lot through but doesn't verify the alternative signature (if present of course). On the other hand, the method X509CertificateHolder.isAlternativeSignatureValid() is checking the alternative signature.

Now for hybrid certificates (that contains both a regular ECDSA signature and an alternative PQC signature like ML-DSA), my understanding is that the certificate verification should / might check both signatures.

Am I correct and if so is there a way to do it ?

Thanks
Sebastien