fixes #2, use a CA for ssh host keys