certctl: Improve option processing

[des]

Summary

For subcommands that did not take any arguments, we never bothered to
check that none were passed.

[des]

local and indentation