Allow setting NotBefore property via init and sign commands

[jmecom]

Adds notbefore as an argument to init and sign to allow setting NotBefore property. If notbefore is not supplied, the NotBefore will be set as 10 minutes earlier than now. I believe this was intended to be the default behavior before, e.g.

// NotBefore is set to be 10min earlier to fix gap on time difference in cluster
NotBefore: time.Now().Add(-600).UTC(),

However, Add takes a Duration as an argument, which is an int64 representing nanoseconds - so I don't think this behaved as described by the comment. I've changed the argument to -time.Minute * 10. Let me know if I should keep it as-is.

[CLAassistant]

All committers have signed the CLA.

[mcpherrinm]

It's kinda weird to call it "NotBefore", but it actually takes an offset from Now(). I'm not sure what exactly to do here. I'd expect NotBefore to take a date, I think. I wonder if we should use a different name for this, but I'm not sure what.