tor-cert: split check-key

see discussion at !999 (comment 2874576)