* Minor follow-ups to #16865 Fix PKI issuer upgrade logic when upgrading to 1.12 or later, to actually turn off the issuer crl-signing usage when it intended to. Fix minor typo in docs. * changelog
