fix subkey certification canonicalization (why did the test not catch this?!)