Good catch.  So should we require both the cert AND key if either is specified?