note startssl's dependency on signing algorithm, cc @GreenReaper