collect errors instead of halting
more masquerade.go fixes I had forgot to backport to the generating script :(
four certificates changed since last scan