use subject key id and authentication key id to ID CA certs in the signers list instead of subject name hashes.