- The self-signed root CA keypair and cert should *not* be used to sign