OpenSSL extension values can be a bit magical, so people seeing this later may not realize that `keyid:always` has special semantics. Could we add a comment in this code explaining how OpenSSL handles this value, or link to http://www.openssl.org/docs/apps/x509v3_config.html#Authority_Key_Identifier_ ?