Turns out that AppBattery is going to autogenerate keys with changing indexes each time.  So I need a much more clever cert/key manager.  Manager now scans for highest matching index using a regexp and using the first sub match as the index.  If there is no submatch (i.e. you gave a full cert name) then it just looks for those.  Once it has determined which cert/key files should be used it checks the timestamps to see if they have changed.