note that "certificate chain" is always exactly two signatures long

@yanmaani pointed out that mention of a "certificate chain" should make it clear that this is not a variable-length chain -- it is always two certificates, never more, never less. Let's not relive the mistakes of X.509.