r9752: figured out why talloc_steal() is a bad idea for SEC_DESC*