result = run_certutil(host, key_args, reqdir)
>       assert 'orphan' not in result.stdout_text
E       assert 'orphan' not in 'certutil: C...rt-pki-kra\n'
E         'orphan' is contained here:
E           certutil: Checking token "NSS Certificate DB" in slot "NSS User Private Key and Certificate Services"
E           < 0> rsa      7b747cc04e9479d74a82913e428a2baf1206f4e1   (orphan)
E         ?                                                           ++++++
E           < 1> rsa      d6f99dfb724e1cf97e9c86a2f67fcc52b0a064d2   NSS Certificate DB:caSigningCert cert-pki-ca
E           < 2> rsa      dbcda39b08e78efae3551bc26a6a54689c5fd245   NSS Certificate DB:ocspSigningCert cert-pki-ca
E           < 3> rsa      88f8fccb5f5b876d1359dfb6a4cbef1099360965   NSS Certificate DB:Server-Cert cert-pki-ca...
E         
E         ...Full output truncated (6 lines hidden), use '-vv' to show