1051c7f
- NSS seems to silently reject importing a certificate with a duplicate nickname, so now we need to always prune out duplicates first