dh: document what the PEM files in apps actually contain.