RFC 5280, 4.2.1.2 says:
  SubjectKeyIdentifier ::= KeyIdentifier
  KeyIdentifier ::= OCTET STRING

Previously, we were failing to unwrap the second level of OCTET STRING
encoding.

Fixes #993.

R=rsc
CC=golang-dev
https://golang.org/cl/1917044