### Is there an existing issue for this?

- [X] I have searched the existing issues

### Current Behavior

```
unable to load Public Key
4343219756:error:0DFFF0A8:asn1 encoding routines:CRYPTO_internal:wrong tag:/AppleInternal/Library/BuildRoots/a0876c02-1788-11ed-b9c4-96898e02b808/Library/Caches/com.apple.xbs/Sources/libressl/libressl-2.8/crypto/asn1/tasn_dec.c:1144:
4343219756:error:0DFFF03A:asn1 encoding routines:CRYPTO_internal:nested asn1 error:/AppleInternal/Library/BuildRoots/a0876c02-1788-11ed-b9c4-96898e02b808/Library/Caches/com.apple.xbs/Sources/libressl/libressl-2.8/crypto/asn1/tasn_dec.c:317:Type=X509_ALGOR
4343219756:error:0DFFF03A:asn1 encoding routines:CRYPTO_internal:nested asn1 error:/AppleInternal/Library/BuildRoots/a0876c02-1788-11ed-b9c4-96898e02b808/Library/Caches/com.apple.xbs/Sources/libressl/libressl-2.8/crypto/asn1/tasn_dec.c:646:Field=algor, Type=X509_PUBKEY
```

I followed these steps "https://aws.amazon.com/fr/blogs/security/how-to-verify-aws-kms-asymmetric-key-signatures-locally-with-openssl/".

### Expected Behavior

Generated a file inst.pem without error.

### How are you starting LocalStack?

With a docker-compose file

### Steps To Reproduce

#### How are you starting localstack (e.g., `bin/localstack` command, arguments, or `docker-compose.yml`)
version: '3.2'

networks:
  netapp:

services:
  localstack:
    image: localstack/localstack:1.2
    environment:
      AWS_ENDPOINT: "http://localstack:4566"
      SERVICES: lambda,apigateway,iam,s3,dynamodb,sts,cloudwatch,events,kms,ssm,kinesis,logs,sns,sqs,secretsmanager
      LAMBDA_EXECUTOR: docker
      DOCKER_HOST: unix:///var/run/docker.sock
      LAMBDA_CONTAINER_REGISTRY: "lambci/lambda"
      LAMBDA_REMOTE_DOCKER: "true"
      LAMBDA_DOCKER_NETWORK: netapp
      HOSTNAME_EXTERNAL: localstack
      EDGE_PORT: 4566
      DEBUG: 1
    ports:
      - 4566:4566
    volumes:
      - /var/run/docker.sock:/var/run/docker.sock

#### Client commands (e.g., AWS SDK code snippet, or sequence of "awslocal" commands)

1. Run ```AWS_REGION=eu-west-3 AWS_ACCESS_KEY_ID=fake AWS_SECRET_ACCESS_KEY=fake aws --endpoint-url="http://localhost:4566" kms create-key --customer-master-key-spec="RSA_2048" --key-usage="SIGN_VERIFY" --description="test1839"```
2. Take the value of "KeyMetadata.KeyId"
3. Run ```AWS_REGION=eu-west-3 AWS_ACCESS_KEY_ID=fake AWS_SECRET_ACCESS_KEY=fake aws --endpoint-url="http://localhost:4566" kms get-public-key --key-id [keyid] --output text --query PublicKey | base64 -d > inst.der```
4. Run ```openssl rsa -pubin -inform DER -outform PEM -in inst.der -pubout -out inst.pem```

Then you obtains this result


I followed these steps "https://aws.amazon.com/fr/blogs/security/how-to-verify-aws-kms-asymmetric-key-signatures-locally-with-openssl/".

I have the version 1.2.0 of localstack, arch arm64.


### Environment

```markdown
- OS: macOs Montery 12.6.1 (MacBook Air (M1, 2020)
- Chip: Apple M1
- Memory: 16 GB
- LocalStack: 1.2.0
```


### Anything else?

It works with the current original AWS.

We started to investigate when the error "x509: malformed tbs certificate" appers in our logs from our application in go.


header = struct.pack(
        CIPHERTEXT_HEADER_FORMAT,
        ciphertext.key_id.encode("utf-8"),
        ciphertext.iv,
        ciphertext.tag,
    )
    return header + ciphertext.ciphertext
def deserialize_ciphertext_blob(ciphertext_blob: bytes) -> Ciphertext:
    header = ciphertext_blob[:HEADER_LEN]
    ciphertext = ciphertext_blob[HEADER_LEN:]
    key_id, iv, tag = struct.unpack(CIPHERTEXT_HEADER_FORMAT, header)
    return Ciphertext(key_id=key_id.decode("utf-8"), iv=iv, ciphertext=ciphertext, tag=tag)
def _serialize_encryption_context(encryption_context: EncryptionContextType) -> bytes:
    aad = io.BytesIO()
    for key, value in sorted(encryption_context.items(), key=lambda x: x[0]):
        aad.write(key.encode("utf-8"))
        aad.write(value.encode("utf-8"))
    return aad.getvalue()
#
class KmsCryptoKey:
    """
    KmsCryptoKeys used to model both of the two cases where AWS generates keys:
    1. Keys that are created to be used inside of AWS. For such a key, its key material / private key are not to
    leave AWS unencrypted. If they have to leave AWS, a different KmsCryptoKey is used to encrypt the data first.
    2. Keys that AWS creates for customers for some external use. Such a key might be returned to a customer with its
    key material or public key unencrypted - see KMS GenerateDataKey / GenerateDataKeyPair. But such a key is not stored
    by AWS and is not used by AWS.
    """
    def __init__(self, key_spec: str):