my company was too scared to roll X509 signing code on their own so here we are.