The pki cert should be replaced with pki ca-cert to clarify that the operation is executed against a CA instead of against the local NSS database.

The pki key should be replaced with pki kra-key to clarify that the operation is executed against a KRA instead of against the local NSS database.