Multiple user certs in s3

Embed the serial # of the cert in the S3 key so a user can have multiple certs available for download.  This won't let them have multiple certs loaded in ssh-agent for the same key, but at least they'll be able to switch between the two.
You'll now need replace=True, right? Since we will be overwriting them? Or does this parameter not do what I think it does?