Separate Keychain.sign into sign (sign by certificate) and signByIdentity