etc-certs: add an intermediate cert, for convenience/distribution