KEYS: Have make canonicalise the paths of the X.509 certs better to deduplicate