New cmdline switch "-p":
Load additional certificate for already loaded private key.
Will refuse to load the certificate if no matching key is found.
Useful if the private key is stored on a PKCS#11 hardware token.