We still have some debian.org certs signed by SPI and USERFirst