Only pushing magic branches: allow a valid push certificate even if the
key is not ultimately trusted. Assume anyone with Submit permission to
the branch is able to verify during review that the code is legitimate.