ssl-proxies: Fix several race conditions

In particular the race in CertificateIOUtil has caused signing policies
be registered with the wrong hash. This in turn causes certificates
from the corresponding CA to be rejected.

(cherry picked from commit 1a0952b493a62e30dfe84937ec76cca00a8b6095)