only finalize in the ./finalize.sh script
remove my fake PINs
switch genrsa from urandom to random

This is a long lived key, so using a better but slower source of random
makes sense here.