Move the work of KeyChain.sign into IdentityManager.signInterestByCertificate.