add support for signing with intermediate certificates