boostrap: update domtool CA to use sha256