Don't sign auto-generated RROs with platform cert

Preinstalled overlays needn't be signed with the same cert
as the package it overlays, simply being preinstalled is
enough. Sign with the default cert instead for now, which
provides fewer special privileges.

Bug: 129373833
Test: internal overlay test
Change-Id: Ie18f7ff749e3f079600f74203664bcb6d11f9d6a