more clarification for key/cert commands