document workflow for certificates and keys