CACreateCert: choose a stronger default hash for longer keys