produce doubled wrapped subjectKeyIdentifier

it turns out that subjectKeyIdentifier is usually a "OCTET STRING, encapsulates { OCTET STRING ..."
the patch will obey this. fixes #18

Sponsored by Lookout Inc.