the csr will be signed iff it has a challengePassword attribute containing a value matching the contents of the "psk" file yeah, UX could use a little work