Add certificate support and restrict teams to listing their s3bucket prefixes.