RT2206: Support issuer in OCSP response signing

The -issuer is trusted to sign OCSP responses.
This is non-delegated, as per RFC 2560.

I also fixed a signed/unsigned cast warning that I
missed when doing the last rebase/merge.