Fix gencert -initca and update README

This is based on internal feedback; previously, gencert would check to see if the CA keyfile parameter was empty in determining whether to generate a new CA key and certificate. However, the parameter has a default value, and is therefore not empty in the standard use case.

This change also updates the README based on a user report.