Should probably switch to 'certfp' everywhere and provide 'fingerprint' as an alias anywhere it was previously accepted.