Merge "Allow shared users to rotate signing certs in an OTA" into pi-dev