add another OTR key, and clarify validity-level-3 cert policy