support Java 6 `keystore` command

The -pass:file syntax was not added to keystore/jarsigner until Java 7.
add city to example X.509 Subject
name the resulting files clearly to prevent mistakes

Having a bunch of files named certificate.*, with some public and some
secret, is bound to trigger someone to do something that they regret.