Fix #3461: protect the use of keepCAFs with #ifdef DYNAMIC