Make GCC16 happy with relayd code

ca.c:348:50: warning: operand of '?:' changes signedness from 'int' to 'unsigned int' due to unsignedness of other operand [-Wsign-compare]
  348 |                 cko.cko_tlen = (ret > 0) ? len : -1;

config.c:1219:36: warning: 'cert' may be used uninitialized [-Wmaybe-uninitialized]
 1219 |                 cert->cert_ocsp_fd = imsg_get_fd(imsg);
      |                 ~~~~~~~~~~~~~~~~~~~^~~~~~~~~~~~~~~~~~~
config.c:1186:34: note: 'cert' was declared here
 1186 |         struct relay_cert       *cert;
      |                                  ^~~~

diff --git a/ca.c b/ca.c
index 4bd3e72..39d1254 100644
--- a/ca.c
+++ b/ca.c
@@ -345,7 +345,7 @@ ca_dispatch_relay(int fd, struct privsep_proc *p, struct imsg *imsg)
 		ret = ECDSA_sign(0, ibuf_data(&ibuf), ibuf_size(&ibuf), to,
 		    &len, ecdsa);
 
-		cko.cko_tlen = (ret > 0) ? len : -1;
+		cko.cko_tlen = (ret > 0) ? (int)len : -1;
 		iov[c].iov_base = &cko;
 		iov[c++].iov_len = sizeof(cko);
 		if (ret > 0) {
diff --git a/config.c b/config.c
index d1f8f8c..073c877 100644
--- a/config.c
+++ b/config.c
@@ -1183,7 +1183,7 @@ config_getrelayfd(struct relayd *env, struct imsg *imsg)
 {
 	struct ctl_relayfd	 crfd;
 	struct relay		*rlay = NULL;
-	struct relay_cert	*cert;
+	struct relay_cert	*cert = NULL;
 
 	if (imsg_get_data(imsg, &crfd, sizeof(crfd)) == -1) {
 		log_warn("%s: imsg_get_data", __func__);