ipsec: Take CA and cert-archive as direct args