The external signing command uses -sha256