add back signing of dns-alt-name certs