Test fixtures have duplicate x509 extension

**What happened**:
When running unit tests with go 1.20 I see the following failure:

```
--- FAIL: TestSign (2.92s)
--- FAIL: TestSign/sign_the_syft_binary_(with_a_password) (0.00s)
sign_test.go:197:
Error Trace: /Users/wagoodman/code/quill/quill/sign_test.go:197
Error: Received unexpected error:
unable to parse certificate 1 of 1: x509: certificate contains duplicate extensions
Test: TestSign/sign_the_syft_binary_(with_a_password)
FAIL
```

We're on go 1.18 now, bumping to 1.20 you will be able to see the same thing locally.

**What you expected to happen**:
No test failures!

**How to reproduce it (as minimally and precisely as possible)**:
`make unit` while using go 1.20.

**Anything else we need to know?**:
More details on the current change in behavior for x509 certificate verification https://groups.google.com/g/golang-checkins/c/nishT5TtWeo .

Start with sign_test.go:197 and the TestSign cases, then run make unit under Go 1.20 to reproduce the x509 duplicate-extension error. Trace the certificate fixture used by the failing password-signing case and remove the duplicate extension; done means the unit suite passes under Go 1.20.

Written by the indexing model from the issue text.