implemented --rekey option to force re-encryption of entries
with the latest configured certificate