For document signatures and such, run this (only when you fully understand the command):
s="$(mktemp)"
cat > "$s" << EOF
-----BEGIN CERTIFICATE-----
MIIBzjCCAXSgAwIBAgIUaHmeGPiA6P9Uma8qBTFZKDzeAMkwCgYIKoZIzj0EAwIw
GzEZMBcGA1UEAwwQUnVueGkgWXUgUm9vdCBDQTAeFw0yNjA3MDMxNjE1MDRaFw0y
ODEwMDUxNjE1MDRaMDIxETAPBgNVBAMMCFJ1bnhpIFl1MR0wGwYJKoZIhvcNAQkB
Fg5tZUBydW54aXl1Lm9yZzBZMBMGByqGSM49AgEGCCqGSM49AwEHA0IABPWVIU7B
w8nikZuu5TNoOwLNjK2XGFejxEqFYZPn0hihlT3a5rCKbLj79UPBMRFvrETioJK8
GsHOYhXokz/NsAmjfzB9MAwGA1UdEwEB/wQCMAAwDgYDVR0PAQH/BAQDAgbAMB0G
A1UdJQQWMBQGCCsGAQUFBwMEBggrBgEFBQcDJDAdBgNVHQ4EFgQUP8jrF9APTe4P
v0z9+3JscOKzPMEwHwYDVR0jBBgwFoAU1OAIi1h9vG0UWqC/tSriYlGweDwwCgYI
KoZIzj0EAwIDSAAwRQIhAOkaQhZib630nft5W+7kK1b+Jf2Vu1pfoWs87OjRlD01
AiBOwH3LpyAR8cPXpbid+TFZvgRiJuX9K8vN4WBbVK4eVw==
-----END CERTIFICATE-----
EOF
certutil -A -n "Runxi Yu (document signing leaf)" -t "P,P,P" -i "$s"
I do have a private CA but you probably don’t want me to be able to vouch for any arbitrary identities.