[CentOS] generate signing subkey