I think this might be simpler if we just dont include any *key.pem, including consumer certs.

We shouldn't need the keys for customer issues.