diff --git a/pki/asn1_util.cc b/pki/asn1_util.cc
deleted file mode 100644
index 3c9cef7..0000000
--- a/pki/asn1_util.cc
+++ /dev/null
@@ -1,353 +0,0 @@
-// Copyright 2012 The Chromium Authors
-// Use of this source code is governed by a BSD-style license that can be
-// found in the LICENSE file.
-
-#include "asn1_util.h"
-
-#include <optional>
-#include "input.h"
-#include "parse_certificate.h"
-#include "parser.h"
-
-namespace bssl::asn1 {
-
-namespace {
-
-// Parses input |in| which should point to the beginning of a Certificate, and
-// sets |*tbs_certificate| ready to parse the Subject. If parsing
-// fails, this function returns false and |*tbs_certificate| is left in an
-// undefined state.
-bool SeekToSubject(der::Input in, der::Parser *tbs_certificate) {
-  // From RFC 5280, section 4.1
-  //    Certificate  ::=  SEQUENCE  {
-  //      tbsCertificate       TBSCertificate,
-  //      signatureAlgorithm   AlgorithmIdentifier,
-  //      signatureValue       BIT STRING  }
-
-  // TBSCertificate  ::=  SEQUENCE  {
-  //      version         [0]  EXPLICIT Version DEFAULT v1,
-  //      serialNumber         CertificateSerialNumber,
-  //      signature            AlgorithmIdentifier,
-  //      issuer               Name,
-  //      validity             Validity,
-  //      subject              Name,
-  //      subjectPublicKeyInfo SubjectPublicKeyInfo,
-  //      ... }
-
-  der::Parser parser(in);
-  der::Parser certificate;
-  if (!parser.ReadSequence(&certificate)) {
-    return false;
-  }
-
-  // We don't allow junk after the certificate.
-  if (parser.HasMore()) {
-    return false;
-  }
-
-  if (!certificate.ReadSequence(tbs_certificate)) {
-    return false;
-  }
-
-  bool unused;
-  if (!tbs_certificate->SkipOptionalTag(
-          der::kTagConstructed | der::kTagContextSpecific | 0, &unused)) {
-    return false;
-  }
-
-  // serialNumber
-  if (!tbs_certificate->SkipTag(der::kInteger)) {
-    return false;
-  }
-  // signature
-  if (!tbs_certificate->SkipTag(der::kSequence)) {
-    return false;
-  }
-  // issuer
-  if (!tbs_certificate->SkipTag(der::kSequence)) {
-    return false;
-  }
-  // validity
-  if (!tbs_certificate->SkipTag(der::kSequence)) {
-    return false;
-  }
-  return true;
-}
-
-// Parses input |in| which should point to the beginning of a Certificate, and
-// sets |*tbs_certificate| ready to parse the SubjectPublicKeyInfo. If parsing
-// fails, this function returns false and |*tbs_certificate| is left in an
-// undefined state.
-bool SeekToSPKI(der::Input in, der::Parser *tbs_certificate) {
-  return SeekToSubject(in, tbs_certificate) &&
-         // Skip over Subject.
-         tbs_certificate->SkipTag(der::kSequence);
-}
-
-// Parses input |in| which should point to the beginning of a
-// Certificate. If parsing fails, this function returns false, with
-// |*extensions_present| and |*extensions_parser| left in an undefined
-// state. If parsing succeeds and extensions are present, this function
-// sets |*extensions_present| to true and sets |*extensions_parser|
-// ready to parse the Extensions. If extensions are not present, it sets
-// |*extensions_present| to false and |*extensions_parser| is left in an
-// undefined state.
-bool SeekToExtensions(der::Input in, bool *extensions_present,
-                      der::Parser *extensions_parser) {
-  bool present;
-  der::Parser tbs_cert_parser;
-  if (!SeekToSPKI(in, &tbs_cert_parser)) {
-    return false;
-  }
-
-  // From RFC 5280, section 4.1
-  // TBSCertificate  ::=  SEQUENCE  {
-  //      ...
-  //      subjectPublicKeyInfo SubjectPublicKeyInfo,
-  //      issuerUniqueID  [1]  IMPLICIT UniqueIdentifier OPTIONAL,
-  //      subjectUniqueID [2]  IMPLICIT UniqueIdentifier OPTIONAL,
-  //      extensions      [3]  EXPLICIT Extensions OPTIONAL }
-
-  // subjectPublicKeyInfo
-  if (!tbs_cert_parser.SkipTag(der::kSequence)) {
-    return false;
-  }
-  // issuerUniqueID
-  if (!tbs_cert_parser.SkipOptionalTag(der::kTagContextSpecific | 1,
-                                       &present)) {
-    return false;
-  }
-  // subjectUniqueID
-  if (!tbs_cert_parser.SkipOptionalTag(der::kTagContextSpecific | 2,
-                                       &present)) {
-    return false;
-  }
-
-  std::optional<der::Input> extensions;
-  if (!tbs_cert_parser.ReadOptionalTag(
-          der::kTagConstructed | der::kTagContextSpecific | 3, &extensions)) {
-    return false;
-  }
-
-  if (!extensions) {
-    *extensions_present = false;
-    return true;
-  }
-
-  // Extensions  ::=  SEQUENCE SIZE (1..MAX) OF Extension
-  // Extension   ::=  SEQUENCE  {
-  //      extnID      OBJECT IDENTIFIER,
-  //      critical    BOOLEAN DEFAULT FALSE,
-  //      extnValue   OCTET STRING }
-
-  // |extensions| was EXPLICITly tagged, so we still need to remove the
-  // ASN.1 SEQUENCE header.
-  der::Parser explicit_extensions_parser(extensions.value());
-  if (!explicit_extensions_parser.ReadSequence(extensions_parser)) {
-    return false;
-  }
-
-  if (explicit_extensions_parser.HasMore()) {
-    return false;
-  }
-
-  *extensions_present = true;
-  return true;
-}
-
-// Parse a DER-encoded, X.509 certificate in |cert| and find an extension with
-// the given OID. Returns false on parse error or true if the parse was
-// successful. |*out_extension_present| will be true iff the extension was
-// found. In the case where it was found, |*out_extension| will describe the
-// extension, or is undefined on parse error or if the extension is missing.
-bool ExtractExtensionWithOID(std::string_view cert, der::Input extension_oid,
-                             bool *out_extension_present,
-                             ParsedExtension *out_extension) {
-  der::Parser extensions;
-  bool extensions_present;
-  if (!SeekToExtensions(der::Input(cert), &extensions_present, &extensions)) {
-    return false;
-  }
-  if (!extensions_present) {
-    *out_extension_present = false;
-    return true;
-  }
-
-  while (extensions.HasMore()) {
-    der::Input extension_tlv;
-    if (!extensions.ReadRawTLV(&extension_tlv) ||
-        !ParseExtension(extension_tlv, out_extension)) {
-      return false;
-    }
-
-    if (out_extension->oid == extension_oid) {
-      *out_extension_present = true;
-      return true;
-    }
-  }
-
-  *out_extension_present = false;
-  return true;
-}
-
-}  // namespace
-
-bool ExtractSubjectFromDERCert(std::string_view cert,
-                               std::string_view *subject_out) {
-  der::Parser parser;
-  if (!SeekToSubject(der::Input(cert), &parser)) {
-    return false;
-  }
-  der::Input subject;
-  if (!parser.ReadRawTLV(&subject)) {
-    return false;
-  }
-  *subject_out = subject.AsStringView();
-  return true;
-}
-
-bool ExtractSPKIFromDERCert(std::string_view cert, std::string_view *spki_out) {
-  der::Parser parser;
-  if (!SeekToSPKI(der::Input(cert), &parser)) {
-    return false;
-  }
-  der::Input spki;
-  if (!parser.ReadRawTLV(&spki)) {
-    return false;
-  }
-  *spki_out = spki.AsStringView();
-  return true;
-}
-
-bool ExtractSubjectPublicKeyFromSPKI(std::string_view spki,
-                                     std::string_view *spk_out) {
-  // From RFC 5280, Section 4.1
-  //   SubjectPublicKeyInfo  ::=  SEQUENCE  {
-  //     algorithm            AlgorithmIdentifier,
-  //     subjectPublicKey     BIT STRING  }
-  //
-  //   AlgorithmIdentifier  ::=  SEQUENCE  {
-  //     algorithm               OBJECT IDENTIFIER,
-  //     parameters              ANY DEFINED BY algorithm OPTIONAL  }
-
-  // Step into SubjectPublicKeyInfo sequence.
-  der::Parser parser((der::Input(spki)));
-  der::Parser spki_parser;
-  if (!parser.ReadSequence(&spki_parser)) {
-    return false;
-  }
-
-  // Step over algorithm field (a SEQUENCE).
-  if (!spki_parser.SkipTag(der::kSequence)) {
-    return false;
-  }
-
-  // Extract the subjectPublicKey field.
-  der::Input spk;
-  if (!spki_parser.ReadTag(der::kBitString, &spk)) {
-    return false;
-  }
-  *spk_out = spk.AsStringView();
-  return true;
-}
-
-bool HasCanSignHttpExchangesDraftExtension(std::string_view cert) {
-  // kCanSignHttpExchangesDraftOid is the DER encoding of the OID for
-  // canSignHttpExchangesDraft defined in:
-  // https://wicg.github.io/webpackage/draft-yasskin-http-origin-signed-responses.html
-  static const uint8_t kCanSignHttpExchangesDraftOid[] = {
-      0x2B, 0x06, 0x01, 0x04, 0x01, 0xd6, 0x79, 0x02, 0x01, 0x16};
-
-  bool extension_present;
-  ParsedExtension extension;
-  if (!ExtractExtensionWithOID(cert, der::Input(kCanSignHttpExchangesDraftOid),
-                               &extension_present, &extension) ||
-      !extension_present) {
-    return false;
-  }
-
-  // The extension should have contents NULL.
-  static const uint8_t kNull[] = {0x05, 0x00};
-  return extension.value == der::Input(kNull);
-}
-
-bool ExtractSignatureAlgorithmsFromDERCert(
-    std::string_view cert, std::string_view *cert_signature_algorithm_sequence,
-    std::string_view *tbs_signature_algorithm_sequence) {
-  // From RFC 5280, section 4.1
-  //    Certificate  ::=  SEQUENCE  {
-  //      tbsCertificate       TBSCertificate,
-  //      signatureAlgorithm   AlgorithmIdentifier,
-  //      signatureValue       BIT STRING  }
-
-  // TBSCertificate  ::=  SEQUENCE  {
-  //      version         [0]  EXPLICIT Version DEFAULT v1,
-  //      serialNumber         CertificateSerialNumber,
-  //      signature            AlgorithmIdentifier,
-  //      issuer               Name,
-  //      validity             Validity,
-  //      subject              Name,
-  //      subjectPublicKeyInfo SubjectPublicKeyInfo,
-  //      ... }
-
-  der::Parser parser((der::Input(cert)));
-  der::Parser certificate;
-  if (!parser.ReadSequence(&certificate)) {
-    return false;
-  }
-
-  der::Parser tbs_certificate;
-  if (!certificate.ReadSequence(&tbs_certificate)) {
-    return false;
-  }
-
-  bool unused;
-  if (!tbs_certificate.SkipOptionalTag(
-          der::kTagConstructed | der::kTagContextSpecific | 0, &unused)) {
-    return false;
-  }
-
-  // serialNumber
-  if (!tbs_certificate.SkipTag(der::kInteger)) {
-    return false;
-  }
-  // signature
-  der::Input tbs_algorithm;
-  if (!tbs_certificate.ReadRawTLV(&tbs_algorithm)) {
-    return false;
-  }
-
-  der::Input cert_algorithm;
-  if (!certificate.ReadRawTLV(&cert_algorithm)) {
-    return false;
-  }
-
-  *cert_signature_algorithm_sequence = cert_algorithm.AsStringView();
-  *tbs_signature_algorithm_sequence = tbs_algorithm.AsStringView();
-  return true;
-}
-
-bool ExtractExtensionFromDERCert(std::string_view cert,
-                                 std::string_view extension_oid,
-                                 bool *out_extension_present,
-                                 bool *out_extension_critical,
-                                 std::string_view *out_contents) {
-  *out_extension_present = false;
-  *out_extension_critical = false;
-  *out_contents = std::string_view();
-
-  ParsedExtension extension;
-  if (!ExtractExtensionWithOID(cert, der::Input(extension_oid),
-                               out_extension_present, &extension)) {
-    return false;
-  }
-  if (!*out_extension_present) {
-    return true;
-  }
-
-  *out_extension_critical = extension.critical;
-  *out_contents = extension.value.AsStringView();
-  return true;
-}
-
-}  // namespace bssl::asn1
diff --git a/pki/asn1_util.h b/pki/asn1_util.h
deleted file mode 100644
index 365c6ed..0000000
--- a/pki/asn1_util.h
+++ /dev/null
@@ -1,73 +0,0 @@
-// Copyright 2012 The Chromium Authors
-// Use of this source code is governed by a BSD-style license that can be
-// found in the LICENSE file.
-
-#ifndef BSSL_PKI_ASN1_UTIL_H_
-#define BSSL_PKI_ASN1_UTIL_H_
-
-#include <string_view>
-#include "fillins/openssl_util.h"
-
-
-
-namespace bssl::asn1 {
-
-// ExtractSubjectFromDERCert parses the DER encoded certificate in |cert| and
-// extracts the bytes of the X.501 Subject. On successful return, |subject_out|
-// is set to contain the Subject, pointing into |cert|.
-OPENSSL_EXPORT bool ExtractSubjectFromDERCert(std::string_view cert,
-                                              std::string_view *subject_out);
-
-// ExtractSPKIFromDERCert parses the DER encoded certificate in |cert| and
-// extracts the bytes of the SubjectPublicKeyInfo. On successful return,
-// |spki_out| is set to contain the SPKI, pointing into |cert|.
-OPENSSL_EXPORT bool ExtractSPKIFromDERCert(std::string_view cert,
-                                           std::string_view *spki_out);
-
-// ExtractSubjectPublicKeyFromSPKI parses the DER encoded SubjectPublicKeyInfo
-// in |spki| and extracts the bytes of the SubjectPublicKey. On successful
-// return, |spk_out| is set to contain the public key, pointing into |spki|.
-OPENSSL_EXPORT bool ExtractSubjectPublicKeyFromSPKI(std::string_view spki,
-                                                    std::string_view *spk_out);
-
-// HasCanSignHttpExchangesDraftExtension parses the DER encoded certificate
-// in |cert| and extracts the canSignHttpExchangesDraft extension
-// (https://wicg.github.io/webpackage/draft-yasskin-http-origin-signed-responses.html)
-// if present. Returns true if the extension was present, and false if
-// the extension was not present or if there was a parsing failure.
-OPENSSL_EXPORT bool HasCanSignHttpExchangesDraftExtension(
-    std::string_view cert);
-
-// Extracts the two (SEQUENCE) tag-length-values for the signature
-// AlgorithmIdentifiers in a DER encoded certificate. Does not use strict
-// parsing or validate the resulting AlgorithmIdentifiers.
-//
-// On success returns true, and assigns |cert_signature_algorithm_sequence| and
-// |tbs_signature_algorithm_sequence| to point into |cert|:
-//
-// * |cert_signature_algorithm_sequence| points at the TLV for
-//   Certificate.signatureAlgorithm.
-//
-// * |tbs_signature_algorithm_sequence| points at the TLV for
-//   TBSCertificate.algorithm.
-OPENSSL_EXPORT bool ExtractSignatureAlgorithmsFromDERCert(
-    std::string_view cert, std::string_view *cert_signature_algorithm_sequence,
-    std::string_view *tbs_signature_algorithm_sequence);
-
-// Extracts the contents of the extension (if any) with OID |extension_oid| from
-// the DER-encoded, X.509 certificate in |cert|.
-//
-// Returns false on parse error or true if the parse was successful. Sets
-// |*out_extension_present| to whether or not the extension was found. If found,
-// sets |*out_extension_critical| to match the extension's "critical" flag, and
-// sets |*out_contents| to the contents of the extension (after unwrapping the
-// OCTET STRING).
-OPENSSL_EXPORT bool ExtractExtensionFromDERCert(std::string_view cert,
-                                                std::string_view extension_oid,
-                                                bool *out_extension_present,
-                                                bool *out_extension_critical,
-                                                std::string_view *out_contents);
-
-}  // namespace bssl::asn1
-
-#endif  // BSSL_PKI_ASN1_UTIL_H_
diff --git a/pki/cert_status_flags.h b/pki/cert_status_flags.h
deleted file mode 100644
index cd66547..0000000
--- a/pki/cert_status_flags.h
+++ /dev/null
@@ -1,49 +0,0 @@
-// Copyright 2012 The Chromium Authors
-// Use of this source code is governed by a BSD-style license that can be
-// found in the LICENSE file.
-
-#ifndef BSSL_PKI_CERT_STATUS_FLAGS_H_
-#define BSSL_PKI_CERT_STATUS_FLAGS_H_
-
-#include <stdint.h>
-#include "fillins/openssl_util.h"
-
-
-
-namespace bssl {
-
-// Bitmask of status flags of a certificate, representing any errors, as well as
-// other non-error status information such as whether the certificate is EV.
-typedef uint32_t CertStatus;
-
-// NOTE: Because these names have appeared in bug reports, we preserve them as
-// MACRO_STYLE for continuity, instead of renaming them to kConstantStyle as
-// befits most static consts.
-#define CERT_STATUS_FLAG(label, value) \
-  CertStatus static const CERT_STATUS_##label = value;
-#include "cert_status_flags_list.h"
-#undef CERT_STATUS_FLAG
-
-static const CertStatus CERT_STATUS_ALL_ERRORS = 0xFF00FFFF;
-
-// Returns true if the specified cert status has an error set.
-inline bool IsCertStatusError(CertStatus status) {
-  return (CERT_STATUS_ALL_ERRORS & status) != 0;
-}
-
-// Maps a network error code to the equivalent certificate status flag. If
-// the error code is not a certificate error, it is mapped to 0.
-// Note: It is not safe to go bssl::CertStatus -> bssl::Error ->
-// bssl::CertStatus, as the CertStatus contains more information. Conversely,
-// going from bssl::Error -> bssl::CertStatus -> bssl::Error is not a lossy
-// function, for the same reason. To avoid incorrect use, this is only exported
-// for unittest helpers.
-OPENSSL_EXPORT CertStatus MapNetErrorToCertStatus(int error);
-
-// Maps the most serious certificate error in the certificate status flags
-// to the equivalent network error code.
-OPENSSL_EXPORT int MapCertStatusToNetError(CertStatus cert_status);
-
-}  // namespace bssl
-
-#endif  // BSSL_PKI_CERT_STATUS_FLAGS_H_
diff --git a/pki/cert_status_flags_list.h b/pki/cert_status_flags_list.h
deleted file mode 100644
index d5ab73c..0000000
--- a/pki/cert_status_flags_list.h
+++ /dev/null
@@ -1,47 +0,0 @@
-// Copyright 2014 The Chromium Authors
-// Use of this source code is governed by a BSD-style license that can be
-// found in the LICENSE file.
-
-// This file intentionally does not have header guards, it's included
-// inside a macro to generate enum values. The following line silences a
-// presubmit warning that would otherwise be triggered by this:
-// no-include-guard-because-multiply-included
-// NOLINT(build/header_guard)
-
-// This is the list of CertStatus flags and their values.
-//
-// Defines the values using a macro CERT_STATUS_FLAG,
-// so it can be expanded differently in some places
-
-// The possible status bits for CertStatus.
-// Bits 0 to 15 are for errors.
-CERT_STATUS_FLAG(COMMON_NAME_INVALID, 1 << 0)
-CERT_STATUS_FLAG(DATE_INVALID, 1 << 1)
-CERT_STATUS_FLAG(AUTHORITY_INVALID, 1 << 2)
-// 1 << 3 is reserved for ERR_CERT_CONTAINS_ERRORS (not useful with WinHTTP).
-CERT_STATUS_FLAG(NO_REVOCATION_MECHANISM, 1 << 4)
-CERT_STATUS_FLAG(UNABLE_TO_CHECK_REVOCATION, 1 << 5)
-CERT_STATUS_FLAG(REVOKED, 1 << 6)
-CERT_STATUS_FLAG(INVALID, 1 << 7)
-CERT_STATUS_FLAG(WEAK_SIGNATURE_ALGORITHM, 1 << 8)
-// 1 << 9 was used for CERT_STATUS_NOT_IN_DNS
-CERT_STATUS_FLAG(NON_UNIQUE_NAME, 1 << 10)
-CERT_STATUS_FLAG(WEAK_KEY, 1 << 11)
-// 1 << 12 was used for CERT_STATUS_WEAK_DH_KEY
-CERT_STATUS_FLAG(PINNED_KEY_MISSING, 1 << 13)
-CERT_STATUS_FLAG(NAME_CONSTRAINT_VIOLATION, 1 << 14)
-CERT_STATUS_FLAG(VALIDITY_TOO_LONG, 1 << 15)
-
-// Bits 16 to 23 are for non-error statuses.
-CERT_STATUS_FLAG(IS_EV, 1 << 16)
-CERT_STATUS_FLAG(REV_CHECKING_ENABLED, 1 << 17)
-// Bit 18 was CERT_STATUS_IS_DNSSEC
-CERT_STATUS_FLAG(SHA1_SIGNATURE_PRESENT, 1 << 19)
-CERT_STATUS_FLAG(CT_COMPLIANCE_FAILED, 1 << 20)
-CERT_STATUS_FLAG(KNOWN_INTERCEPTION_DETECTED, 1 << 21)
-
-// Bits 24 - 31 are for errors.
-CERT_STATUS_FLAG(CERTIFICATE_TRANSPARENCY_REQUIRED, 1 << 24)
-CERT_STATUS_FLAG(SYMANTEC_LEGACY, 1 << 25)
-CERT_STATUS_FLAG(KNOWN_INTERCEPTION_BLOCKED, 1 << 26)
-// Bit 27 was CERT_STATUS_LEGACY_TLS.