puppetsigner: only fetch unsigned certs

Change-Id: I343cf516d3e0e015fb6dd42e1fbc0ca9b06cc64e
Signed-off-by: Giuseppe Lavagetto <glavagetto@wikimedia.org>