need to be able to replace user public key certs