ca: pkey generation should return the pkey object