Don't add the TS EKU by default in openssl.cnf because it then