begin key cross-certification
change signing key type
adds cross-cert, but is not valid