upgrade key when signed by old key