what assumptions do we want to make about the pre-existing user-cert relationships before this command is run.  For instance, as written this command will never subtract a cert if re-run, even if criteria change.  should we make it that way?  (a delete somewhere would do the trick)