use keyformat for -x509toreq, don't hard code PEM