x509 CA certificates are encoded with a subjectKeyIdentifier