modsign: Use if_changed rule for extracting cert from module signing key