Default cert start time to 2 min in past
Default cert start time to 2 min in past

Helps especially when clocks aren't synchronized very well. When the
signing daemon goes to validate the cert it may not be valid for another
minute or so in the future. By subtracting 2 minutes, as an arbitrary
starting point, we help guarantee that the certificate is ready for use
now.

This needs to change more in the future anyway. The signing daemon needs
to allow certificates that aren't valid yet to support requesting
certificates that don't become valid until some point in the future (for
example reqesting a certificate during normal business hours for a
midnight maintenance window).

bobveznat/ssh-ca-ss