pki: Choose default digest based on the signature key