Improve explicit certificate specification

- Support cert/key in the same PEM file
- Rationalize arguments, expand tests, clean up a bit