Diceware passwords; support using existing certs