swanctl doesn't do any (online) certificate validation, it just parses and or decrypts them and passes them on to the daemon.
This ensures that packets on sun are processed on a particular CPU and not randomly on one, which causes expected SAs not to get created or other weird things.