[backend] use '-h sha256' when creating new keys

Older signd versions will ignore it, but newer ones
will use the --cert-digest-algo to set the hash algo
for the signatures.