Add sub-CA generation and signing support

The build-ca command now takes a subca option.

Added a new sign-ca-req command with modifications to sign_req() to
handle ca signing.