roots; check that key name is appropriate even if it is a security root; added/clarified log messages