Support SCM sub-ca certificate signed by leader SCM's sub-ca certificate

Current solution:
SCM sub-CA can only been signed by primordial SCM root CA

Proposed solution:
SCM sub-CA will be signed by leader SCM. If leader SCM is the primordial SCM, then the new sub-CA certificate will be signed by root CA certificate, otherwise, it will be signed by leader SCM's sub-CA certificate.