enforce that type == 'CERTIFICATE', 'PRIVATE KEY', etc