new keys are cross-certified