pki: Support an --addrblock option for self-signed certificates