Consider applying local exceptions during validation.

[partim]

Specifically, if a CA’s resources are fully covered by prefix filters (i.e., prefix filters without a asn member cover all address resources and BGPsec filters with only the asn members cover all the ASN resources in the CA), don’t process the CA at all.

This can help with defining filters for known problematic CAs or repositories.