sign keys with CA: sign_keys=<nonempty>, auto-sign keys: sign_keys=<empty>