Fix gencert -initca and update README

This is based on internal feedback; previously, gencert would check to
see if the CA keyfile parameter was empty in determining whether to
generate a new CA key and certificate. However, the parameter has a
default value, and is therefore not empty in the standard use case.

This change also updates the README based on a user report.
Merge pull request #31 from cloudflare/kyle/initca-docs

Fix gencert -initca and update README