sdidiag deals with tree keys, which is different than certificates.