Move SSD certificate guards off nullable Kotlin

ober

f59a4b2e81b346e64e0fab3ff6f0e37c9f68c414

diff --git a/templates/ssd-review.ss b/templates/ssd-review.ss
index 5b0567b..b808a78 100644
--- a/templates/ssd-review.ss
+++ b/templates/ssd-review.ss
@@ -8894,8 +8894,9 @@
        "        }"
        "        connection.connect()"
        "        if (connection is HttpsURLConnection && remoteConfigHasPin(config)) {"
-       "            val certificate = connection.serverCertificates.firstOrNull()"
-       "                ?: throw SSLPeerUnverifiedException(\"Server provided no certificate\")"
+       "            val certificates = connection.serverCertificates"
+       "            if (!positiveCount(certificates.size)) throw SSLPeerUnverifiedException(\"Server provided no certificate\")"
+       "            val certificate = certificates[0]"
        "            val actualPin = MessageDigest.getInstance(\"SHA-256\").digest(certificate.publicKey.encoded)"
        "            if (constantTimeNullableBytesMismatch(actualPin, config.spkiSha256)) {"
        "                connection.disconnect()"
@@ -8920,7 +8921,8 @@
        ""
        "            override fun checkServerTrusted(chain: Array<X509Certificate>, authType: String) {"
        "                platform.checkServerTrusted(chain, authType)"
-       "                val leaf = chain.firstOrNull() ?: throw CertificateException(\"Server provided no certificate\")"
+       "                if (!positiveCount(chain.size)) throw CertificateException(\"Server provided no certificate\")"
+       "                val leaf = chain[0]"
        "                val actual = MessageDigest.getInstance(\"SHA-256\").digest(leaf.publicKey.encoded)"
        "                if (constantTimeBytesMismatch(actual, expectedPin)) {"
        "                    throw CertificateException(\"SSD service identity pin mismatch\")"