private key can now be anywhere in the .pem

clean up attribute cert generation code since creddy based on openssl is now much more flexible