add removeChallenge
check stored key ID during certificate verification