RFC 5280 requires CAs to have SKID, but Go does not set it by default (golang/go#26676).

It's as easy as making a SHA-1 call: https://github.com/FiloSottile/mkcert/blob/fcdbc54cc34e4b2da4d01fbbbdd8cb640f23db5f/cert.go#L281