Should we prompt for the password if they don't give one? Or can you have passwordless certificates? The reason I ask is that users might be more comfortable if they can type in their password and have it masked, rather than in plain text on the command line.