restructure certs/keys; add key/cert generation