cleanup, make attr certs indexed by scope