allow master key updates by removing old primary ID cert