Sign with certutil instead of openssl

Using certutil let's us sign with whatever CA is in the Qpid NSS DB,
instead of having to have the CA cert and key out somewhere in the file
system.  This situation is mainly of concern when running the script
where a Qpid CA is already in the NSS DB.