[mod] removed shell based approach
[enh] added manifest
[enh] sub CA to mitigate MITM through Root CA key compromise, other small fixes