pki: Use SHA-256 as default for signatures