Fixed #63 : The KeyUsage of the created proxy is never more permissive
then the effective KU of the parent cert chain. Additionally it is
possible to set a mask which can further limit the KU. It is checked if
dsig flag is always set.