Move certificate config down into generator code Read available signing certificates from poppler NSS