SPKAC can be instantiated with challenge=None and somehow yield usable client certs

[phryk]

Okay, so I'm not sure what exactly I'm trying to accomplish with this issue.

<keygen> is sadly dying and this project seems pretty dead, too.

But if you somehow stumbled into maintaining something using this thing, take care to make sure you're not passing None for the challenge parameter as I'm pretty sure this has security implications (vulnerable to replay attacks, maybe?).
Mostly I'm just confused why this even yields usable certificates…