(PUP-3176) Sign CSR with best digest available