After changing the DB upgrade to not include empty keys for the cert

fields (to make it more consistent with newly created repos), I didn't
go back to address the filesystem upgrade which assumed they'd always be
present.