Never mind. I see now that it's handled later. I guess comparing old key to old certificate is to verify that we have made the right assumptions in the code, since it should never fail.