Some fixes (notably to credential generation, which is mysteriously
complex, alas).