If the subjectAlternativeKey is available in the CA, use it as authority key on
the new certificate. Otherwise embed the serial number.
The key id is included in the signed certificates according to
RFC5280 section-4.2.1.1. Anchor uses the first recommended method of keyid
generation. The behaviour matches openssl.
Change-Id: I883f8d5d9dc3430443aa08fdf2448bf385575557