sign certificates

fixes #3