certool: use unencrypted key first