Currently this is only supported for OCSP, not for EE cert signing. Also clean up some things in the CA unittest.