dont ask for a CSR country code on second runs because the CSR is already generated and any new country code won't be used anyway
first pass at a management tool for checking what the user must do to finish his configuration: set NS records, DS records, sign his certificates, etc.