Use SHA-1 of DER-encoding of cert (if available) for local key ID.