add requirement of no direct-from-root signing