Use separate certificates for signing and decryption.