allow client to specify arbitrary keys for a certificate