Only generate user certificates for user data bags with "vpn":true