x509_cert_policy and default values of host cert host key CAdir
We should not have default values on x509_host_cert x509_host_key x509_cert_dir since it now depends on the x509_cert_policy, and having set a default causes non-transparency (if user sets system policy and does not specify/set andy of the other, the parameters will be incompatible).