Make the getcert test include preserving rekey
    
    When using getcert to drive rekeying, also test with preserving enabled,
    and go check that the key for the old certificate is in the expected
    location after we've replaced both it and the certificate.  We can't
    export the key if there's no certificate to go with it, so use the ID,
    which certutil prints, as a stand-in for the key contents.