domtool-addcert: use domtool-config, support non-afs cert/key dirs