Use cert's Subject.CommonName (the phone number) to find identity instead of extracting pubkey and iterating DB. Each cert is bound to a number; the cert tells us which number directly. Also verify cert pubkey matches stored identity pubkey.
50344a350a