Nit: clarify x509 cert format