Build ServiceLoader manifests for ks CLI
Only compare the head certificate in ManagedKeystore
Fix bug where not allowed synthetic links