move the signer into the standard tool

as a hidden option to discourage use
use temporary args_info for parsing if auth is needed
refactor to let request-cert and selfsign-cert use different hashes

namely sha1 and sha512 as well with sha256 as default