don't map kCUIAttrCredentialSecCertificate for now