netdoc: Fix enc-key-cert construction

According to the spec, the subject key of the enc-key-cert is " is the the ed25519 equivalent of a curve25519 public encryption key (KP_hss_ntor), with the ed25519 key derived using the process in proposal 228 appendix A.". When deriving the ed25519 key, we set the sign bit to 0, which is wrong. Proposal 228 appendix A says the sign bit is obtained as follows:

   To get the sign, the easiest way is to take the same private key,
   feed it to the ed25519 public key generation algorithm, and see
   what the sign is.