ca-sign: Add instructions for generating CA key and cert to header.