Use the right certificate to sign. Wrong one works for me locally, but fails for everyone else and me when I download.