expect public key as opaque text when certifying