use cdi (certDigestInfo) claim for cert binding