Why do physical certs of ckmx have to be sent in?