When creating normal (non-CA) certificates, require their CA
Add examples