add -rmd option to set OCSP response signing digest