chained certs now included in credential signature