"This is controlled via the security.content.signature.root_hash preference, where the value is the hexadecimal of the sha2$ https://github.com/mozilla-services/autograph/blob/3dc9cfc9585bb8bc7b2b22f618ef8abadf18ddc9/signer/contentsignature/README.$
- get chain from x5u for normandy_key: in autograph dev config
- wget https://content-signature.stage.mozaws.net/chains/normandy.content-signature.mozilla.org-20180811.stage.chain
- split last pem cert in file from chain (should be root CN; check with openssl x509 -text)
- openssl x509 -outform der < normandy.content-signature.mozilla.org-20180811.stage.chain.2 | openssl dgst -sha256