GeneralName has a new Invalid variant to catch invalid data, such that a list of names can be parsed even if e.g. a single DNSName has invalid bytes. The problem is the way this was done, it will catch a GeneralName that has an invalid tag entirely, and that doesn't seem to be the intent here. If I try to parse a GeneralName with tag 10, that should be a real error rather than Invalid data, just as trying to parse a GeneralName with a class of Application is still a real error. Like with the class assertion, the tag should be asserted outside of the code where errors are caught.