Currently, OCSP responses that aren't signed by the root CA will fail with a verification error. This change allows intermediates, or designated responders, to sign responses on behalf of the CA.