mkcert: Use CA_HOST variable in scp to signing host