include example for secret sharing callback in clca.cfg
distinguish between "root ca" and "issued certificate" extensions