sigtool: Add print-certs command to allow dumping certs without a scan