dropped -selfsign option; revoke certificates that are re-generated but not expired...