use certification keys to sign keyrings