switch to plain pkcs1 padding, no PSS, we should have sufficient randomness within what's being signed and PSS isn't well supported in most language/crypto bindings yet