stroke: Use separate credential sets for CA/AA certificates