Replaced keyskeystore with one that uses RSA for signing (deterministic). Further testing needed, but it works and gets the expected result when visiting google.com