(PUP-3176) Sign CSR with best digest available

`md = md` typo?