Only continue from cert sign step if the cert is actually signed

Without this, it was possible for an agent to check in between the
"sign all" step and the "check for the cert" step. In such a case, we
would continue without signing the cert because we could see it is
there. With this change, we now verify that the cert is signed, not
just that it exists.