for (int i = 0; i < pkeyinfo_collection.size(); i++) {
        Vector<Object> pkeyinfo_v = pkeyinfo_collection.elementAt(i);
        PrivateKeyInfo pkeyinfo = (PrivateKeyInfo) pkeyinfo_v.elementAt(0);
        String nickname = (String) pkeyinfo_v.elementAt(1);
        if (! masterList.contains(nickname)) {
            // TODO - fix this to only import the keys that we need.
            CMS.debug("Ignoring " + nickname);
            // only import the master's system keys
            //    continue;
        }
        byte[] x509cert = getX509Cert(nickname, cert_collection);
        X509Certificate cert = cm.importCACertPackage(x509cert);
        ByteArrayOutputStream bos = new ByteArrayOutputStream();
        pkeyinfo.encode(bos);
        byte[] pkey = bos.toByteArray();

        PublicKey publickey = cert.getPublicKey();
        CryptoToken token = cm.getInternalKeyStorageToken();
        CryptoStore store = token.getCryptoStore();

        try {
            store.deleteCert(cert);
        } catch (NoSuchItemOnTokenException e) {
            // this is OK
        }

        KeyGenerator kg = token.getKeyGenerator(KeyGenAlgorithm.DES3);
        SymmetricKey sk = kg.generate();
        byte iv[] = { 0x1, 0x1, 0x1, 0x1, 0x1, 0x1, 0x1, 0x1 };
        IVParameterSpec param = new IVParameterSpec(iv);
        Cipher c = token.getCipherContext(EncryptionAlgorithm.DES3_CBC_PAD);
        c.initEncrypt(sk, param);
        byte[] encpkey = c.doFinal(pkey);

        KeyWrapper wrapper = token.getKeyWrapper(KeyWrapAlgorithm.DES3_CBC_PAD);
        wrapper.initUnwrap(sk, param);
        wrapper.unwrapPrivate(encpkey, getPrivateKeyType(publickey), publickey);

    }

    for (int i = 0; i < cert_collection.size(); i++) {

        Vector<Object> cert_v = cert_collection.elementAt(i);
        byte[] cert = (byte[]) cert_v.elementAt(0);
        if (cert_v.size() > 1) {
            String name = (String) cert_v.elementAt(1);
            if (! masterList.contains(name)) {
                CMS.debug("Not importing " + name);
                // only import the master's system certs
                continue;
            }
            // we need to delete the trusted CA certificate if it is
            // the same as the ca signing certificate
            if (isCASigningCert(name)) {
                X509Certificate certchain = getX509CertFromToken(cert);
                if (certchain != null) {
                    CryptoToken token = cm.getInternalKeyStorageToken();
                    CryptoStore store = token.getCryptoStore();
                    if (store instanceof PK11Store) {
                        try {
                            PK11Store pk11store = (PK11Store) store;
                            pk11store.deleteCertOnly(certchain);
                        } catch (Exception ee) {
                            CMS.debug("importKeyCert: Exception=" + ee.toString());
                        }
                    }
                }
            }

            X509Certificate xcert = cm.importUserCACertPackage(cert, name);
            if (isCASigningCert(name)) {
                // we need to change the trust attribute to CT
                InternalCertificate icert = (InternalCertificate) xcert;
                icert.setSSLTrust(InternalCertificate.TRUSTED_CA
                        | InternalCertificate.TRUSTED_CLIENT_CA
                        | InternalCertificate.VALID_CA);
            } else if (isAuditSigningCert(name)) {
                InternalCertificate icert = (InternalCertificate) xcert;
                icert.setObjectSigningTrust(InternalCertificate.USER
                        | InternalCertificate.VALID_PEER | InternalCertificate.TRUSTED_PEER);
            }
        } else {
            cm.importCACertPackage(cert);
        }
    }