fix cert-signing, somewhat