Key::list: Skip Certificate::new for empty buffers

This matches the C code behaviour.

src/key.rs

@@ -125,9 +125,11 @@ impl Key {
                 }
             };
 
+            if !buf.is_empty() {
                 let cert = Certificate::new(buf)?;
                 keys.push(Key { slot, cert });
             }
+        }
 
         Ok(keys)
     }