Which of the following should be used to sign the user’s certificates?