PR2442: Warn if -DIGEST given too late

The -cert and -serial flags set the digest to SHA1.
If followed by -DIGEST (e.g., -sha256) the default
will have been set, so print a warning.