only sign keys if private key has capability