Allow setting NotBefore property via init and sign commands

[jmecom]

Adds notbefore as an argument to init and sign to allow setting NotBefore property. If notbefore is not supplied, the NotBefore will be set as 10 minutes earlier than now. I believe this was intended to be the default behavior before, e.g.

// NotBefore is set to be 10min earlier to fix gap on time difference in cluster
NotBefore: time.Now().Add(-600).UTC(),

However, Add takes a Duration as an argument, which is an int64 representing nanoseconds - so I don't think this behaved as described by the comment. I've changed the argument to -time.Minute * 10. Let me know if I should keep it as-is.

[CLAassistant]

Thank you for your submission! We really appreciate it. Like many open source projects, we ask that you sign our Contributor License Agreement before we can accept your contribution.

---

jm seems not to be a GitHub user. You need a GitHub account to be able to sign the CLA. If you have already a GitHub account, please add the email address used for this commit to your account.
_{You have signed the CLA already but the status is still pending? Let us recheck it.}

[mcpherrinm]

It's kinda weird to call it "NotBefore", but it actually takes an offset from Now(). I'm not sure what exactly to do here. I'd expect NotBefore to take a date, I think. I wonder if we should use a different name for this, but I'm not sure what.