Merge "Add ROLLBACK past signing cert capability." into pi-dev