pki-sub-ca: update design