<bourbon> looks like there's a certs object on pki
<bourbon> which is fed into certmgr....
<bourbon> ok, I guess that's just it